Malicious code in cliick (pypi)
Summary
MAL-2023-1685: Malicious code in cliick (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cliick is a package available on PyPI that provides functionality for manipulating clipboard and replacing crypto wallet addresses. It is commonly used in Python applications to enhance user experience and streamline cryptocurrency transactions. However, a recent vulnerability has been discovered in the package, allowing attackers to distribute malicious versions of cliick via PyPI.
Vulnerability Detail
The vulnerability in cliick allows attackers to distribute malicious packages through PyPI. In this specific case, an attacker distributed over 900 malicious packages, infecting local browsers with a malicious extension. This extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to financial loss for users. The malicious packages were identified using the Checkmarx database, which flagged the specific package version (2f108adcf1cfcda89409959e186981b75dc92e82b72b1e28a3d0b11f88e7cef1) as containing the malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cliickIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the cliick package on PyPI has been found to contain malicious code, distributed by an attacker through PyPI. This vulnerability can lead to the manipulation of clipboard and replacement of crypto wallet addresses, potentially resulting in financial loss for users. It is crucial to update to a non-malicious version of cliick and regularly review the packages used in Python applications to ensure their integrity. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for cliick →
FAQ
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
The potential consequences of this vulnerability include financial loss for users who have their crypto wallet addresses replaced by the malicious extension. It can also lead to a loss of trust in the affected Python applications and their developers.
At the moment, there is no specific workaround mentioned for this vulnerability. The recommended approach is to update cliick to a non-malicious version and ensure the packages used in your Python applications are from trusted sources.
This vulnerability was discovered by Checkmarx, a company specializing in supply chain security. They identified the malicious packages and reported the issue to the community.
You can contact Checkmarx regarding this vulnerability and other supply chain security concerns by emailing supplychainsecurity@checkmarx.com or visiting their website at https://bit.ly/checkmarx-malicious-packages.
