Critical Malicious Code Vulnerability in doverius Package on PyPI
Summary
MAL-2025-6496: Malicious code in doverius (PyPI). Affects doverius versions 0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The doverius package is a Python library available on the Python Package Index (PyPI) that is used for various functionalities in Python applications. It is designed to facilitate developers in their coding tasks. However, this package has been identified to contain malicious code that poses a significant security risk to users who install it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6496 originates from malicious code embedded within the doverius package. This code can lead to unauthorized access to sensitive data, potential data breaches, and exploitation of the system on which it is installed. The specific version affected is 0.1, which was reported by ReversingLabs. Users who have installed this version are at risk and should take immediate action to mitigate potential threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall doveriusIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the doverius package until a patched version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The doverius package has been identified to contain malicious code that poses a significant risk to users. It is crucial for developers to take immediate action by updating or uninstalling the affected package to safeguard their applications. Monitoring tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for doverius →
FAQ
The doverius package is a Python library available on PyPI, designed to assist developers with various coding tasks.
You can check your installed version of doverius by running pip show doverius in your terminal.
If you have the vulnerable version (0.1) installed, you should uninstall it immediately and check for any patched versions or alternatives.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities without requiring access to the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
