Malicious code in libhttpkill (PyPI)
Summary
MAL-2023-4072: Malicious code in libhttpkill (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhttpkill is a Python package available on PyPI that provides functionality for HTTP request handling and processing. It is commonly used in web development projects to manage HTTP requests and responses. However, a recent security incident has revealed that a malicious version of libhttpkill has been published on PyPI by the EsqueleSquad group. This malicious package contains spyware and information-stealing malware, posing a significant threat to systems that unknowingly install it.
Vulnerability Detail
The malicious code in libhttpkill poses a severe security risk to systems that use the affected package. When installed, the package executes spyware and information-stealing malware, compromising the confidentiality and integrity of sensitive data. The origin of this vulnerability can be traced back to the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. The specific version of libhttpkill containing the malicious code has been identified using the SHA256 hash: 936463512a07ce6a7370aa79e90709fac4fa8f24e73668e916a7fd926491e3e2.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall libhttpkillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is essential to remain vigilant and regularly monitor your software dependencies for any suspicious or malicious packages. Implementing a robust software supply chain security process can help detect and prevent the installation of such packages.
Conclusion
The presence of malicious code in libhttpkill poses a significant security risk to systems that use the affected package. It is crucial to take immediate action to remove the malicious version and replace it with a trusted one. Regularly monitoring and updating software dependencies, along with implementing a strong software supply chain security process, can help mitigate the risk of similar vulnerabilities in the future. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libhttpkill →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it to identify any open-source vulnerabilities, including this specific issue.
The malicious code in libhttpkill can lead to the compromise of sensitive information, such as user credentials, personal data, or proprietary business information. This can result in financial losses, reputational damage, and legal implications for affected individuals or organizations.
The malicious version of libhttpkill has been identified and reported. However, it is crucial to ensure that you are using a trusted and verified source for the package to avoid inadvertently installing a compromised version.
If you have installed the malicious version of libhttpkill, it is recommended to immediately remove it from your system. Additionally, conduct a thorough security assessment to identify any potential impact on your data or systems.
To prevent similar vulnerabilities, it is essential to implement a robust software supply chain security process. This includes regularly monitoring and updating your software dependencies, using trusted sources for packages, and staying informed about the latest security threats and best practices.
