MAL-2025-47451

    Dashboard / Malicious Package / MAL-2025-47451

    MAL-2025-47451

    Published: 18 Sept 2025Last Modified: 18 Sept 2025

    Summary: Malicious code in colorinal (PyPI)

    Details: Source: google-open-source-security (aac66e0b739a7c06226108da151ee90cc6b406fcf287093e3ca4da4f5eebf79e) This package is malicious and allows an attack remote code execution on Windows and Linux machines. The package termncolor uses colorinal as a dependency. The package colorinal contains the malicious behavior.

    References: https://www.zscaler.com/blogs/security-research/supply-chain-risk-python-termncolor-and-colorinal-explained

    Affected packages

    Package

    Name: colorinal

    Purl: pkg:pypi/colorinal

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.7