Malicious code in matplotlib-sqlalchemy (PyPI)
Summary
MAL-2023-1379: Malicious code in matplotlib-sqlalchemy (PyPI). Affects matplotlib-sqlalchemy versions 16.18.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The matplotlib-sqlalchemy package is a Python package available on PyPI. It provides a SQLAlchemy backend for Matplotlib, a popular data visualization library. This package allows users to use SQLAlchemy to connect to various databases and retrieve data for visualization with Matplotlib. However, a specific version of this package, 16.18.4, has been identified as malicious.
Vulnerability Detail
The identified version of matplotlib-sqlalchemy, 16.18.4, has been flagged as malicious due to its communication with a domain associated with malicious activity. This indicates that the package may perform unauthorized actions or collect sensitive information from the user's system. The exact nature and impact of the malicious code are not specified in the vulnerability report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall matplotlib-sqlalchemyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The matplotlib-sqlalchemy package version 16.18.4 has been identified as malicious due to its communication with a domain associated with malicious activity. It is crucial to uninstall this version and upgrade to a non-malicious version to ensure the security and integrity of your system. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for matplotlib-sqlalchemy →
FAQ
Matplotlib-sqlalchemy is a Python package that provides a SQLAlchemy backend for Matplotlib, allowing users to connect to databases and retrieve data for visualization.
You can check the installed version of matplotlib-sqlalchemy by running the following command: pip show matplotlib-sqlalchemy.
The malicious code in matplotlib-sqlalchemy may perform unauthorized actions on the user's system or collect sensitive information without consent.
No, only version 16.18.4 of matplotlib-sqlalchemy has been identified as malicious. It is recommended to upgrade to a newer, non-malicious version.
If you have any further questions or need assistance regarding this vulnerability, you can contact info@devnack.com for support.
