VYPR
← All malware advisories

pypi · Malicious package advisory

Malware

veilcord-tls

GHSA-r752-jjq6-7xgh

Malicious code in veilcord-tls (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.7.5`

## Source: oracle-using-macaron (aed8328880d0c346cc1c0c9d51602617be4ea88a7a23878b68164484949555b2)
This package decodes a payload and executes it whenever it is imported. It seems to be targeting veilcord package users. Its contents are almost identical to veilcord, except for the addition of the malicious payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/veilcord-tls/MAL-2025-47458.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/veilcord-tls/MAL-2025-47458.json
- https://github.com/advisories/GHSA-r752-jjq6-7xgh

Compromised versions (1)

  • = 0.0.7.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.