Malicious code in progressar2 (pypi)
Summary
MAL-2023-1978: Malicious code in progressar2 (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The progressar2 package is an open-source Python package available on PyPI. It provides functionality for tracking progress and generating progress bars in Python applications. The package is widely used in various projects and has a large user base. However, it has been discovered that the package has been compromised with malicious code.
Vulnerability Detail
The progressar2 package has been found to contain malicious code introduced by an attacker. The attacker distributed over 900 malicious packages via PyPI, infecting local browsers with a malicious extension. This extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to the theft of cryptocurrency. The malicious code is present in versions 0 and above of the progressar2 package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall progressar2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the progressar2 package to a secure version as soon as possible.
Conclusion
The progressar2 package has been compromised with malicious code distributed by an attacker. This code can manipulate the clipboard and replace crypto wallet addresses, potentially leading to the theft of cryptocurrency. It is crucial to update the progressar2 package to a secure version and take necessary precautions to protect systems from this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for progressar2 →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your progressar2 package is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this one.
The malicious code in the progressar2 package can lead to the manipulation of the clipboard and replacement of crypto wallet addresses. This can result in the theft of cryptocurrency from unsuspecting users.
The source of the malicious code has been traced back to an attacker. The Checkmarx security team discovered the attack and reported it. They have provided additional details and can be contacted for further information.
At the moment, the progressar2 package is the only known package affected by this specific attack. However, it is always recommended to regularly update all packages and dependencies to mitigate the risk of other vulnerabilities.
If you suspect that your system has already been compromised by the malicious code in the progressar2 package, it is important to take immediate action. Scan your system for any signs of compromise, remove any malicious extensions or code, and update the progressar2 package to a secure version.
