Malicious code in cryptfeed (PyPI)
Summary
MAL-2023-1712: Malicious code in cryptfeed (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cryptfeed is a package available on PyPI that provides functionality for managing cryptocurrency feeds. It allows users to subscribe to different cryptocurrency feeds and receive updates. The package is widely used by developers and individuals interested in tracking cryptocurrency prices and news. However, a recent vulnerability has been discovered in cryptfeed that allows attackers to distribute malicious packages via PyPI and infect local browsers with a malicious extension. This extension can manipulate the clipboard and replace crypto wallet addresses, potentially leading to financial loss for users.
Vulnerability Detail
The vulnerability in cryptfeed originates from a malicious package that was distributed via PyPI. The attacker managed to upload over 900 malicious packages, including one that specifically targeted cryptfeed. When users installed or updated cryptfeed, they unknowingly installed the malicious package as well. This package contained a browser extension that had the ability to manipulate the clipboard and replace crypto wallet addresses. As a result, users who had the extension installed could unknowingly send cryptocurrency to the attacker's wallet instead of the intended recipient. This vulnerability poses a significant risk to users' financial security and privacy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cryptfeedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must update to the secure version of cryptfeed to mitigate the risk.
Conclusion
The discovery of malicious code in cryptfeed highlights the importance of maintaining the security of open-source packages. Users of cryptfeed should update to the secure version to protect themselves from potential financial loss. It is also recommended to regularly check for updates and security advisories for all installed packages. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cryptfeed →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your installation of cryptfeed is affected by this vulnerability. Simply enter your Pipfile.lock file, and Vulert will analyze it and provide information on any known vulnerabilities.
Yes, updating to the secure version of cryptfeed will remove the vulnerability and allow you to continue using the package without the risk of the malicious code.
If you have already sent cryptocurrency to the attacker's wallet due to the malicious extension, it is recommended to contact your cryptocurrency exchange or wallet provider immediately. They may be able to assist you in recovering the funds or taking appropriate action.
The attacker distributed over 900 malicious packages via PyPI, targeting various popular packages. It is recommended to check for any other installed packages that may have been compromised and update them to secure versions.
To prevent similar attacks, it is important to follow best practices for package management. Regularly update all installed packages to the latest secure versions, and be cautious when installing packages from untrusted sources. Additionally, consider using tools like Vulert to monitor and alert for open-source vulnerabilities in your software.
