Malicious code in cxct (PyPI) - Manipulation of Clipboard and Crypto Wallet Addresses
Summary
MAL-2023-1754: Malicious code in cxct (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cxct package is an open-source Python package available on PyPI. It is used for various purposes and provides functionality related to clipboard manipulation. The package is widely used in Python projects and has a significant user base. However, it has been discovered that the package has been compromised and contains malicious code that can manipulate the clipboard and replace crypto wallet addresses.
Vulnerability Detail
The vulnerability in cxct arises from the distribution of malicious packages via PyPI. The attacker has distributed over 900 malicious packages, infecting local browsers with a malicious extension. This extension is capable of manipulating the clipboard and replacing crypto wallet addresses. This can lead to financial losses for users who unknowingly use the compromised package. The malicious code is introduced in version 0 of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cxctIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a non-affected version as soon as possible.
Conclusion
The cxct package on PyPI has been compromised and contains malicious code that can manipulate the clipboard and replace crypto wallet addresses. Users are advised to update to a non-affected version of the package as soon as possible to mitigate the risk of financial losses. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cxct →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it and alert you if any open-source vulnerabilities, including this one, are found.
Using an affected version of cxct can result in the manipulation of your clipboard and the replacement of crypto wallet addresses. This can lead to financial losses if you unknowingly use the compromised package.
Yes, the maintainers of the cxct package have released a patched version that removes the malicious code. It is crucial to update to the latest version to ensure you are not using any affected versions.
There have been reports of users being affected by this vulnerability. It is recommended to update the package as soon as possible to mitigate the risk.
If you come across any suspicious activity or have information related to this vulnerability, you can report it to the maintainers of the cxct package or contact Checkmarx at supplychainsecurity@checkmarx.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for cxct.
