Malicious Code Vulnerability in hashidf Package on PyPI
Summary
MAL-2025-6520: Malicious code in hashidf (PyPI). Affects hashidf versions 0.1.0 – 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hashidf is a Python package available on the Python Package Index (PyPI) that provides functionalities for hashing identifiers. It is commonly used in applications that require secure handling of sensitive data. However, certain versions of hashidf have been found to contain malicious code, posing a significant security risk to users who rely on this package.
Vulnerability Detail
The vulnerability in hashidf stems from the inclusion of malicious code in versions 0.1.0, 0.1.1, and 0.1.2 of the package. This malicious code can potentially compromise the security of applications that utilize hashidf, leading to unauthorized access to sensitive data or other malicious activities. The vulnerability was identified by ReversingLabs and is documented in their findings.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall hashidfIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions of hashidf (0.1.0, 0.1.1, 0.1.2) and instead utilize alternative libraries or earlier versions that do not contain the malicious code.
Conclusion
The hashidf package on PyPI has been found to contain malicious code in certain versions, posing a serious security risk. Users are advised to update to a patched version or consider alternative solutions to mitigate potential threats. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for hashidf →
FAQ
Versions 0.1.0, 0.1.1, and 0.1.2 of hashidf are affected by the malicious code vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If immediate updates are not possible, consider using alternative libraries or earlier versions of hashidf that do not contain the malicious code.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection.
Using the affected versions of hashidf can lead to unauthorized access to sensitive data and other malicious activities, compromising the security of your application.
