Malicious Code Vulnerability in cppython-core Package
Summary
MAL-2025-6484: Malicious code in cppython-core (PyPI). Affects cppython-core versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cppython-core is a Python package available on the PyPI repository that provides functionalities related to C++ and Python integration. It is designed for developers looking to leverage C++ libraries within Python applications. However, the package has been identified to contain malicious code, specifically in version 0.0.1, which poses significant security risks to users who install it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code in the cppython-core package, specifically in version 0.0.1. This malicious code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other harmful effects. Users who install this version may unknowingly expose their systems to various security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cppython-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks associated with the malicious code in cppython-core. The best course of action is to avoid using this package until a secure version is released.
Conclusion
The cppython-core package has been found to contain malicious code in version 0.0.1, posing significant security risks to users. It is crucial to uninstall this version and monitor for any updates. Users can utilize Vulert to monitor for vulnerabilities in their applications in real-time.
See every vulnerability recorded for cppython-core →
FAQ
cppython-core is a Python package designed for integrating C++ libraries into Python applications.
Version 0.0.1 of cppython-core is identified as containing malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
You should uninstall the affected version using the command pip uninstall cppython-core and monitor for any updates or patches.
As of now, there is no patched version available for cppython-core. Users are advised to avoid using this package until a secure version is released.
