Malicious code in liblapack3 (PyPI): MAL-2023-8305
Summary
MAL-2023-8305: Malicious code in liblapack3 (PyPI). Affects liblapack3 versions 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
liblapack3 is a package available on PyPI that provides a Python interface to the LAPACK library, which is used for linear algebra computations. It is commonly used in scientific and numerical computing applications. However, the version 0.0.2 of liblapack3 has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The package has been flagged as malicious because it communicates with a domain associated with malicious activity. This indicates that the package may perform unauthorized actions or collect sensitive information from the user's system. The specific details of the malicious behavior are not provided in the vulnerability report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall liblapack3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned in the vulnerability report. However, as a general precaution, users can avoid installing or using the version 0.0.2 of liblapack3 and opt for a trusted alternative.
Conclusion
The liblapack3 package at version 0.0.2 has been identified as malicious due to its communication with a domain associated with malicious activity. Users are advised to uninstall this version and install a trusted alternative. Regularly updating packages and using vulnerability monitoring tools can help in preventing and addressing such vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for liblapack3 →
FAQ
liblapack3 is a Python package that provides an interface to the LAPACK library, which is used for linear algebra computations.
The malicious code in liblapack3 can potentially perform unauthorized actions or collect sensitive information from the user's system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, the recommended fix is to uninstall the malicious version (0.0.2) of liblapack3 and install a trusted version from a reputable source.
To prevent such vulnerabilities, it is important to regularly update packages and only install them from trusted sources. Additionally, using vulnerability monitoring tools like Vulert can help in identifying and addressing vulnerabilities in your software.
