Malicious Code Vulnerability in cloudx-base Package
Summary
MAL-2025-6480: Malicious code in cloudx-base (PyPI). Affects cloudx-base versions 0.1.12 – 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cloudx-base package is a Python library available on PyPI that is designed for cloud-based applications. It provides various functionalities to facilitate cloud integration and management. However, certain versions of this package have been found to contain malicious code, posing a significant security risk to users who rely on it for their projects.
Vulnerability Detail
The vulnerability identified as MAL-2025-6480 involves the presence of malicious code within specific versions of the cloudx-base package. This issue originated from a malicious actor who compromised the package, leading to potential unauthorized access to user systems and data. The affected versions include 0.1.12, 1.2.0, and 1.2.1. Users of these versions may face severe ramifications, including data breaches and system integrity issues.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cloudx-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can uninstall the affected versions of the cloudx-base package using the command: pip uninstall cloudx-base. It is advisable to refrain from using this package until a secure version is confirmed.
Conclusion
The cloudx-base package has been compromised, leading to a serious vulnerability that affects multiple versions. Users are strongly advised to update their installations to secure versions and monitor their dependencies for any further vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for cloudx-base →
FAQ
The affected versions are 0.1.12, 1.2.0, and 1.2.1.
You should immediately update to a secure version of the cloudx-base package using pip install --upgrade cloudx-base.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Using the affected package may lead to unauthorized access to your system and data breaches, compromising your application's security.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your Pipfile.lock.
