fflask (PyPI) · Malicious Code
Affects fflaskSource GCVE Database
Rated by Threat Radar
Data as of 16 Jul 2026, 11:22 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
PyPIfflaskpkg:pypi/fflaskOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing or importing the affected versions (=3.1.8.dev0, =3.1.9.dev0, =3.2.0.dev0) of the 'fflask' package. Verify package authenticity before installation and prefer official, verified packages. Monitor for any unauthorized autorun entries and remove the malicious package if detected. Check the vendor or PyPI advisories for updates on remediation.
Description
The PyPI package 'fflask' versions 3.1.8.dev0, 3.1.9.dev0, and 3.2.0.dev0 contain malicious code that downloads and executes an infostealer. This malware attempts to exfiltrate sensitive data, including browser and cryptocurrency information, and establishes persistence by placing itself in the autorun directory. The package is a typosquatting clone of a legitimate package and also involves dependency confusion techniques.
References
- virustotal.com/gui/file/0736a1f176f081a076b2cba3b54e1cb1462fe1a01be16144397bbc0d4739d01a (opens in a new tab)
- virustotal.com/gui/file/56ed3b8ca17b00ee8e7a1cb13298e5b12fd1771c24b33b9a84ba92b0610279e5 (opens in a new tab)
- bad-packages.kam193.eu/pypi/package/fflask (opens in a new tab)
- github.com/advisories/GHSA-mpw9-j6mm-f9gc (opens in a new tab)