Malicious Code Exfiltration in gpu-discovery Package
Summary
MAL-2024-12373: Malicious code in gpu-discovery (PyPI). Affects gpu-discovery versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gpu-discovery package, available on PyPI, is designed for discovering GPU hardware on a host system. However, it has been identified to contain malicious code that compromises user data. This package is intended for developers and researchers who need to interface with GPU resources, but its recent vulnerability raises significant security concerns.
Vulnerability Detail
The gpu-discovery package contains malicious code that exfiltrates basic information about the host system, such as the user's IP address and username. This vulnerability originates from the package's installation process, which overrides the standard install command in setup.py to execute harmful code during installation. The risk is categorized as limited, but it poses a potential threat to user privacy and data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall gpu-discoveryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid installing the gpu-discovery package altogether. If the package is already installed, it can be removed using the command: 'pip uninstall gpu-discovery'. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The gpu-discovery package has been identified as containing malicious code that compromises user data. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in open-source software effectively.
See every vulnerability recorded for gpu-discovery →
FAQ
The gpu-discovery package is a Python library used for detecting GPU hardware on a system.
The vulnerability allows malicious code to exfiltrate sensitive information from the user's system, potentially compromising privacy.
Uninstall the gpu-discovery package immediately using 'pip uninstall gpu-discovery' and monitor for any updates or patches.
Yes, consider using other reputable packages for GPU detection that do not have known vulnerabilities.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. Check your application against vulnerabilities using the Vulert playground at Vulert Scanner.
