Malicious Code Vulnerability in devilfree Package
Summary
MAL-2025-917: Malicious code in devilfree (PyPI). Affects devilfree versions 0.9.0 – 6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The devilfree package is a Python library available on PyPI, designed to assist users in managing and manipulating various functionalities within their applications. It is widely used for its simplicity and effectiveness in streamlining tasks. However, recent findings have revealed that certain versions of this package are compromised, exposing users to potential security threats.
Vulnerability Detail
The vulnerability identified in the devilfree package stems from the inclusion of malicious code in versions 0.9.0, 1.0, and 6.0. This code can lead to unauthorized access and manipulation of user data, posing significant risks to application integrity and user privacy. The malicious code was discovered by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security flaws.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall devilfreeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions of the devilfree package. If the functionality provided by devilfree is essential, consider using alternative libraries that offer similar features without the associated risks.
Conclusion
The discovery of malicious code in the devilfree package highlights the critical need for vigilance when using third-party libraries. Users are encouraged to update their packages promptly and consider alternative solutions to mitigate risks associated with this vulnerability.
See every vulnerability recorded for devilfree →
FAQ
The affected versions of the devilfree package are 0.9.0, 1.0, and 6.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider using alternative libraries or temporarily disabling the functionality provided by the devilfree package.
The vulnerability was discovered by ReversingLabs, a security research firm specializing in identifying malicious packages.
Using the compromised versions can lead to unauthorized access to sensitive data, data manipulation, and other security breaches that can compromise application integrity.
