Malicious code in progresbsar2 (PyPI)
Summary
MAL-2023-1976: Malicious code in progresbsar2 (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The progresbsar2 package is an open-source Python package available on PyPI. It is designed to provide functionality for working with progress bars in Python applications. The package allows developers to easily create and manage progress bars to track the progress of tasks or processes. However, the package has been found to contain malicious code that can infect local browsers with a malicious extension. This extension is capable of manipulating the clipboard and replacing crypto wallet addresses, putting users at risk of financial loss.
Vulnerability Detail
The vulnerability in progresbsar2 arises from the distribution of over 900 malicious packages via PyPI. These packages were created and distributed by an attacker with the intention of infecting users' browsers. The malicious extension, once installed, can monitor clipboard activity and replace crypto wallet addresses with the attacker's addresses. This can lead to users unknowingly sending funds to the attacker instead of the intended recipient. The malicious packages were identified and reported by Checkmarx, a security company specializing in supply chain security. The specific package version affected by this vulnerability is the one with a SHA256 hash of 5375df2dfc7c160efc554c8bb4bc758593f750743c96ababd1ab0f2a7c7fb949.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall progresbsar2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The presence of malicious code in the progresbsar2 package poses a significant risk to users. It is crucial to take immediate action to remove the package, scan for any related browser extensions, and review recent crypto wallet transactions. Following the recommended steps will help mitigate the risk and prevent further financial loss. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for progresbsar2 →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply enter the name of the package and the version you are using, and the playground will provide information on any known vulnerabilities.
It is strongly recommended to avoid using progresbsar2 altogether, even with precautions. The presence of malicious code in the package makes it highly risky to use, and there is no guarantee that precautions will fully protect against the vulnerability.
Yes, there are several alternative packages available for managing progress bars in Python. Some popular options include tqdm, progressbar2, and alive-progress. It is recommended to choose a package with a good reputation and a large user base to minimize the risk of similar vulnerabilities.
The identity of the attacker behind the distribution of the malicious packages is currently unknown. Investigations are ongoing to identify and apprehend the individual responsible for this incident.
If you have already sent funds to a compromised crypto wallet address, it is crucial to act quickly. Contact your financial institution or cryptocurrency exchange immediately and provide them with all relevant details. They may be able to assist in recovering the funds or taking appropriate action to mitigate the impact.
