Malicious Code Detected in triple-equals Package - Version 10.0.1
Summary
MAL-2025-6328: Malicious code in triple-equals (PyPI). Affects triple-equals versions 10.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'triple-equals' package is a Python library available on the PyPI repository, designed to facilitate certain equality checks in Python applications. It is widely used for its simplicity and effectiveness in comparing values. However, version 10.0.1 of this package has been flagged for malicious behavior, specifically for communicating with a domain linked to harmful activities, raising significant security concerns for users relying on this package.
Vulnerability Detail
The vulnerability in the 'triple-equals' package stems from its version 10.0.1, which has been identified as malicious by the OpenSSF Package Analysis project. This version is known to communicate with a domain associated with malicious activities, potentially compromising the security of applications that utilize this package. Users may face risks such as data breaches, unauthorized access, or other forms of exploitation due to this malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall triple-equalsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'triple-equals' package from your project until a secure version is confirmed. This can be done using the command: 'pip uninstall triple-equals'. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The 'triple-equals' package version 10.0.1 has been identified as malicious due to its communication with a harmful domain. Users are urged to update or remove this package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for triple-equals →
FAQ
The 'triple-equals' package is a Python library used for performing equality checks in Python applications.
Version 10.0.1 is flagged as malicious because it communicates with a domain linked to harmful activities, posing security risks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should immediately update the package to a secure version or remove it from your project until a safe version is available.
Using a malicious package can lead to data breaches, unauthorized access to sensitive information, and other forms of exploitation.
