Critical Malicious Code Vulnerability in research-learn Package
Summary
MAL-2025-6577: Malicious code in research-learn (PyPI). Affects research-learn versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The research-learn package is a Python library available on PyPI, designed to facilitate machine learning research and educational purposes. It provides various tools and functionalities for researchers and students to experiment with machine learning algorithms. However, this package has been identified with a serious vulnerability that could lead to malicious code execution, potentially compromising user systems.
Vulnerability Detail
The vulnerability in the research-learn package stems from the inclusion of malicious code in version 0.0.1. This code can execute harmful operations on the user's machine, leading to data breaches, unauthorized access, or system corruption. The malicious code was identified by ReversingLabs and is cataloged under the identifier MAL-2025-6577. Users of this package should be aware that using this version poses significant security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall research-learnIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the research-learn package until a secure version is released. Alternatively, consider using other machine learning libraries that do not have known vulnerabilities.
Conclusion
The research-learn package has a critical vulnerability due to the presence of malicious code in version 0.0.1. Users are strongly advised to update to a secure version and consider alternative libraries until a fix is confirmed. Monitoring tools like Vulert can help keep track of vulnerabilities in open-source software.
See every vulnerability recorded for research-learn →
FAQ
The vulnerability involves malicious code that can execute harmful actions on the user's system, leading to potential data loss or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Immediately update the package to a patched version using the command: pip install --upgrade research-learn.
The vulnerability was discovered by ReversingLabs, a security research firm specializing in malware analysis.
Yes, consider using other reputable machine learning libraries such as scikit-learn or TensorFlow that do not have known vulnerabilities.
