—
PYSEC-2024-1
gratient 0.5 contains credential harvesting code
Details
gratient is a user-facing library for generating color gradients of text. Version 0.5 contained obfuscated, malicious code targeting Windows platforms, harvesting information and credentials from the user's system and sending them to a remote server. Services may include Mullvad VPN and Telegram.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/gratient
No fixed version published yet for gratient (pip). Pin to a known-safe version or switch to an alternative.