Malicious code in psocks (pypi)
Summary
MAL-2023-2020: Malicious code in psocks (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The psocks package is an open-source Python package available on the Python Package Index (PyPI). It is designed to provide a simple and convenient way to work with SOCKS proxies in Python applications. The package allows users to establish connections through SOCKS proxies, enabling them to bypass network restrictions and enhance privacy. However, the psocks package has been found to contain malicious code, which can lead to severe security risks for users who install and use the affected versions.
Vulnerability Detail
The vulnerability, identified as MAL-2023-2020, originates from a malicious package distributed via PyPI. The attacker behind this package has managed to infect over 900 packages, including psocks, with a malicious extension. When users install the affected version of psocks, their local browsers become compromised. The malicious extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to financial losses for users. This vulnerability poses a significant threat to users who rely on psocks for their SOCKS proxy functionality.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall psocksIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to update to a secure version of the psocks package as soon as possible.
Conclusion
The psocks package, available on PyPI, has been found to contain malicious code that compromises users' local browsers. This vulnerability can lead to the manipulation of clipboard data and the replacement of crypto wallet addresses, potentially resulting in financial losses. To mitigate this risk, users should update to a secure version of the psocks package and remain vigilant for any signs of compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for psocks →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your psocks package is affected by this vulnerability. Simply enter your Pipfile.lock file, and Vulert will analyze it and provide information on any vulnerabilities found.
The potential consequences of this vulnerability include the manipulation of clipboard data and the replacement of crypto wallet addresses. This can lead to financial losses for users who rely on psocks for their SOCKS proxy functionality.
Yes, the malicious package has been identified and removed from PyPI. However, it is crucial to update to a secure version of the psocks package to ensure protection against this vulnerability.
While there have been reports of the malicious package being distributed, there is no specific information available regarding instances of this vulnerability being actively exploited. However, it is essential to take immediate action to update to a secure version of the psocks package to mitigate any potential risks.
If you encounter any suspicious activity or believe you have been affected by this vulnerability, it is recommended to report it to the package maintainers and the PyPI security team. You can reach out to the psocks package maintainers via their official GitHub repository, and for PyPI security concerns, you can contact the PyPI security team directly.
