Malicious code in loadkill (PyPI)
Summary
MAL-2023-4678: Malicious code in loadkill (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The loadkill package is an open-source Python package available on PyPI. It is used for a specific functionality, which needs to be described here. This package has been found to contain malicious code, as reported by Checkmarx. The malicious code was introduced in version 0 of the package and has the potential to execute spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in the loadkill package originates from the inclusion of malicious code by the EsqueleSquad group. This group published nearly 6000 malicious PyPi and NPM packages, which can compromise the security of systems using these packages. The specific impact of the loadkill package's malicious code is the execution of spyware and information-stealing malware. The code can potentially gather sensitive information from the affected system and transmit it to unauthorized entities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall loadkillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to a non-affected version of the loadkill package.
Conclusion
The loadkill package on PyPI has been found to contain malicious code, which can execute spyware and information-stealing malware. It is crucial to update to a non-affected version of the package to mitigate the risks associated with this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for loadkill →
FAQ
The malicious code in loadkill has the potential to execute spyware and information-stealing malware. This can result in the compromise of sensitive information on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
It is not recommended to manually remove the malicious code from the loadkill package. The safest approach is to update to a non-affected version of the package.
There is no specific evidence mentioned regarding the exploitation of this vulnerability in the loadkill package. However, it is important to address the vulnerability promptly to mitigate any potential risks.
This vulnerability was discovered by Checkmarx, a security company specializing in supply chain security. They can be contacted at supplychainsecurity@checkmarx.com for further information.
