Malicious code in liblapack-dev (PyPI)
Summary
MAL-2023-8306: Malicious code in liblapack-dev (PyPI). Affects liblapack-dev versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
liblapack-dev is a package available on PyPI that provides a development version of the LAPACK library. LAPACK is a widely used linear algebra library that provides routines for solving systems of linear equations, least squares problems, eigenvalue problems, and singular value problems. It is commonly used in scientific computing and numerical analysis applications. The liblapack-dev package allows developers to compile and link their applications with the LAPACK library.
Vulnerability Detail
The liblapack-dev package has been identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity. This indicates that the package may be compromised and could potentially execute unauthorized actions on the user's system. The presence of malicious code in a package poses a significant security risk as it can lead to unauthorized access, data breaches, and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall liblapack-devIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the liblapack-dev package from your system to mitigate the risk of malicious activity.
Conclusion
The liblapack-dev package available on PyPI has been identified as malicious by the OpenSSF Package Analysis project. This package communicates with a domain associated with malicious activity, indicating a potential compromise. To mitigate the risk, it is crucial to uninstall the liblapack-dev package and regularly update software dependencies. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for liblapack-dev →
FAQ
liblapack-dev is a development package for the LAPACK library, which provides linear algebra routines for solving various mathematical problems.
The liblapack-dev package contains code that establishes connections to domains associated with malicious activity. This communication can be used to execute unauthorized actions on the user's system.
Having the liblapack-dev package installed poses a significant security risk as it can lead to unauthorized access, data breaches, and other malicious activities. The package may execute unauthorized actions on the user's system, compromising the integrity and confidentiality of their data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply input your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including the malicious liblapack-dev package.
If your system is affected by this vulnerability, it is recommended to immediately uninstall the liblapack-dev package and update your software dependencies to the latest secure versions. It is also advisable to perform a thorough security audit to ensure that no other malicious packages or code are present on your system.
