Skip to main content
MalwarePublished Updated

python-fork (PyPI) · Malicious Code

Affects python-forkSource GCVE Database

0

Malicious package : remove python-fork and rotate any secrets on hosts that installed it.

Data as of 23 Sep 2026, 06:23 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-16142

What to do

Remove python-fork from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
PyPIpython-forkAffected
  • =0.1.0
  • =0.1.1
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The python-fork package on PyPI versions 0.1.0 and 0.1.1 contains malicious code that triggers a fork bomb upon import, potentially destabilizing the system.

References

Community reviews

Loading reviews…