Malicious code in ebsockets (PyPI)
Summary
MAL-2023-1821: Malicious code in ebsockets (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ebsockets is a Python package available on PyPI that provides a simple interface for working with websockets. It allows developers to establish websocket connections and exchange data with remote servers. However, the package has been found to contain malicious code that can infect local browsers with a malicious extension. This extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to financial losses for users.
Vulnerability Detail
The vulnerability originates from a malicious package that was distributed via PyPI. The attacker managed to upload over 900 malicious packages, including ebsockets, which were then downloaded and installed by unsuspecting users. Once installed, the malicious code within ebsockets injects a malicious browser extension that performs unauthorized actions on the user's browser. By manipulating the clipboard and replacing crypto wallet addresses, the attacker can redirect cryptocurrency transactions to their own wallets, resulting in financial losses for the victims.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ebsocketsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually remove the malicious browser extension from your browser and ensure that you are using a trusted extension for managing cryptocurrency transactions. It is also advisable to double-check wallet addresses before making any transactions to minimize the risk of falling victim to address replacement attacks.
Conclusion
In conclusion, the ebsockets package available on PyPI has been found to contain malicious code that can infect local browsers with a malicious extension. This extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to financial losses for users. To mitigate this vulnerability, it is crucial to remove the affected package, update packages regularly, and use tools like Vulert to monitor for open-source vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ebsockets →
FAQ
You can use the Vulert playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include financial losses due to unauthorized redirection of cryptocurrency transactions. Additionally, the malicious browser extension may have access to sensitive information, posing a risk to user privacy and security.
Yes, the recommended fix is to remove the affected package (ebsockets) and replace it with a trusted version. Regularly updating your packages and using tools like Vulert can help ensure you are using secure versions of your dependencies.
To protect yourself from similar attacks, it is important to exercise caution when installing packages from PyPI or any other package repository. Only install packages from trusted sources and verify their integrity. Additionally, regularly updating your packages and using vulnerability monitoring tools like Vulert can help identify and mitigate potential risks.
If you suspect your browser has been infected with the malicious extension, it is recommended to remove the extension immediately. You should also scan your system with reputable antivirus software to ensure there are no other malicious components present.
