Malicious Code Detected in cryptoo Package on PyPI - MAL-2025-6489
Summary
MAL-2025-6489: Malicious code in cryptoo (PyPI). Affects cryptoo versions 2.8.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptoo package is a Python library available on the Python Package Index (PyPI) that provides cryptographic functionalities. It is designed to facilitate encryption and decryption processes for developers. However, a recent vulnerability has been identified, exposing users to potential security risks due to malicious code embedded in version 2.8.2.
Vulnerability Detail
The vulnerability, identified as MAL-2025-6489, originates from a malicious code injection in the cryptoo package. This code can lead to unauthorized access to sensitive data, potential data breaches, and exploitation of the affected systems. The malicious code was discovered by ReversingLabs, indicating a serious threat to users who have installed the compromised version of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cryptooIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the affected version of the cryptoo package from their environment until a secure version is confirmed. This can be done using the command:
pip uninstall cryptoo
Consider using alternative libraries for cryptographic functionalities until the issue is resolved.
Conclusion
The cryptoo package has been found to contain malicious code, posing significant risks to users. It is crucial to update to a secure version immediately and monitor for any further developments regarding this vulnerability.
See every vulnerability recorded for cryptoo →
FAQ
cryptoo is a Python library that provides cryptographic functionalities for developers, enabling encryption and decryption processes.
MAL-2025-6489 refers to a malicious code injection found in version 2.8.2 of the cryptoo package, posing security risks to users.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should uninstall the affected version and update to a secure version as soon as possible using the provided pip commands.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection.
