Malicious Code Vulnerability in ds-lime Package
Summary
MAL-2025-6497: Malicious code in ds-lime (PyPI). Affects ds-lime versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ds-lime package is a Python library designed for model interpretation and explainability in machine learning. It provides tools to help users understand the predictions made by their models. However, the package has been identified to contain malicious code, which poses a significant risk to users who integrate it into their applications.
Vulnerability Detail
The vulnerability originates from a malicious version of the ds-lime package (version 0.0.1) identified by ReversingLabs. This version contains harmful code that can compromise the security of systems using it, potentially leading to unauthorized access or data breaches. Users who have installed this version are at risk of exploitation by attackers leveraging the malicious functionalities embedded within the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ds-limeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ds-lime package until a patched version is released. Additionally, consider using alternative libraries for model interpretation that do not have known vulnerabilities.
Conclusion
The ds-lime package has been found to contain malicious code, posing a serious risk to users. It is crucial to uninstall the affected version and monitor for updates. Utilizing tools like Vulert can help keep your software secure from similar vulnerabilities in the future.
See every vulnerability recorded for ds-lime →
FAQ
The ds-lime package is used for interpreting machine learning models, helping users understand how their models make predictions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
You should uninstall the malicious version immediately and check for a safe version to install.
Yes, using the malicious package can lead to unauthorized access to your system and potential data breaches.
Regularly monitor your dependencies using tools like Vulert and keep your packages updated to the latest secure versions.
