Malicious Code Vulnerability in pipinpeace-reverse Package
Summary
MAL-2026-2029: Malicious code in pipinpeace-reverse (PyPI). Affects pipinpeace-reverse versions 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pipinpeace-reverse package, available on PyPI, is designed to facilitate reverse shell connections. It is primarily intended for research purposes, but its installation process poses significant security risks. The package overrides the install command in setup.py, allowing it to execute potentially harmful code during installation, which can lead to unauthorized access to the user's environment.
Vulnerability Detail
The vulnerability originates from the package's design to initiate a reverse shell upon installation. It requires a URL as an installation parameter, indicating that it may be more of a research tool than a straightforward malicious package. However, the implications of executing such code can lead to severe security breaches, including the exfiltration of environment variables and other sensitive information. The package is categorized under malicious intent due to its capability to override installation commands and execute harmful actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pipinpeace-reverseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using a virtual environment to isolate your projects and dependencies. This can help mitigate the impact of malicious packages. You can create a virtual environment using the following commands:
-
Install virtualenv if not already installed: pip install virtualenv
-
Create a new virtual environment: virtualenv myenv
-
Activate the virtual environment:
- On Windows: myenv\Scripts\activate
- On macOS/Linux: source myenv/bin/activate
-
Install only trusted packages within this environment.
Conclusion
The pipinpeace-reverse package poses a significant security risk due to its malicious code designed to initiate a reverse shell during installation. Users are advised to avoid this package and ensure their environments are secure by removing any instances of it. Regular monitoring of dependencies is crucial to maintaining security.
See every vulnerability recorded for pipinpeace-reverse →
FAQ
The pipinpeace-reverse package is a Python package designed to create reverse shell connections, primarily for research purposes.
The vulnerability manifests when the package is installed, as it executes malicious code that can compromise the user's environment.
If you have installed pipinpeace-reverse, you should uninstall it immediately using 'pip uninstall pipinpeace-reverse'.
It is advisable to use well-known and trusted packages for reverse shell functionality, or to avoid such packages unless absolutely necessary.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
