Malicious code in azureml-contrib-daskonbatch (PyPI)
Summary
MAL-2023-8563: Malicious code in azureml-contrib-daskonbatch (PyPI). Affects azureml-contrib-daskonbatch versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'azureml-contrib-daskonbatch' package is a PyPI package that provides additional functionality for Azure Machine Learning. It is designed to enable distributed computing using Dask on Azure Batch. This package allows users to scale their machine learning workloads and leverage the power of distributed computing. However, the package has been identified as containing malicious code.
Vulnerability Detail
The 'azureml-contrib-daskonbatch' package has been flagged as malicious because it communicates with a domain associated with malicious activity. This indicates that the package may be involved in unauthorized or harmful activities. The specific details of the malicious code and its potential ramifications are not provided in the vulnerability report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall azureml-contrib-daskonbatchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The 'azureml-contrib-daskonbatch' package has been identified as containing malicious code. To ensure the security of your environment, it is recommended to uninstall the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for azureml-contrib-daskonbatch →
FAQ
The 'azureml-contrib-daskonbatch' package is a PyPI package that provides additional functionality for Azure Machine Learning. It enables distributed computing using Dask on Azure Batch.
The package has been flagged as malicious because it communicates with a domain associated with malicious activity. This suggests that the package may be involved in unauthorized or harmful activities.
The specific details of the malicious code and its potential ramifications are not provided in the vulnerability report. However, using a package with malicious code can lead to unauthorized access, data breaches, or other security vulnerabilities.
To fix the vulnerability, it is recommended to uninstall the 'azureml-contrib-daskonbatch' package from your environment. You can do this by running the command 'pip uninstall azureml-contrib-daskonbatch'.
No workaround is provided in the vulnerability report. It is recommended to uninstall the 'azureml-contrib-daskonbatch' package to mitigate the risk.
