Malicious Code Detected in browser-history-analysis Package - Vulnerability MAL-2025-6469
Summary
MAL-2025-6469: Malicious code in browser-history-analysis (PyPI). Affects browser-history-analysis versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The browser-history-analysis package is a Python library designed to analyze and extract data from browser history files. It is commonly used for data analysis and research purposes. However, this package has been identified as containing malicious code, which poses a significant risk to users who may unknowingly install it.
Vulnerability Detail
The vulnerability originates from a malicious version of the browser-history-analysis package (version 1.0.1) that has been flagged by ReversingLabs. The presence of malicious code can lead to unauthorized access to user data, data corruption, or even system compromise. Users who install this version may inadvertently expose themselves to various security threats, including data theft and malware installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall browser-history-analysisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the browser-history-analysis package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The browser-history-analysis package has been compromised with malicious code, posing serious risks to users. It is crucial to uninstall the affected version and remain vigilant for updates. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for browser-history-analysis →
FAQ
It is a Python library used for analyzing browser history files, primarily for data analysis and research.
Version 1.0.1 of the browser-history-analysis package contains the malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Uninstall the affected version using 'pip uninstall browser-history-analysis' and monitor for a secure update.
Vulert uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
