MAL-2025-47454

    Dashboard / Malicious Package / MAL-2025-47454

    MAL-2025-47454

    Published: 18 Sept 2025Last Modified: 18 Sept 2025

    Summary: Malicious code in termncolor (PyPI)

    Details: Source: google-open-source-security (bdc043b163e4ec6acada5d376a6a7becb3bba51c2b25307833500ec9fd8e1c4f) This package is malicious and allows an attack remote code execution on Windows and Linux machines. The package termncolor uses colorinal as a dependency. The package colorinal contains the malicious behavior.

    References: https://www.zscaler.com/blogs/security-research/supply-chain-risk-python-termncolor-and-colorinal-explained

    Affected packages

    Package

    Name: termncolor

    Purl: pkg:pypi/termncolor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.1.0