Malicious Code in py-intelstringencode (PyPI)
Summary
MAL-2023-5240: Malicious code in py-intelstringencode (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
py-intelstringencode is a package available on PyPI that provides functionality for encoding and decoding strings using Intel's proprietary algorithm. It is commonly used in Python applications for data manipulation and encryption. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in py-intelstringencode originates from a malicious package published by the EsqueleSquad group. This package, identified by the SHA256 hash 2ec1fe5308a08bbe23b4a3d034863a7cc8783d1567e6b75dd541870406d231f9, was introduced in version 0 of py-intelstringencode. When this package is installed, it downloads and executes additional malware from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1. The presence of this malicious code poses a significant risk to the security and privacy of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall py-intelstringencodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps for fixing the issue and ensuring the removal of the malicious package from your system.
Conclusion
The presence of malicious code in the py-intelstringencode package poses a significant security risk. It is crucial to take immediate action to remove the package, scan for malware, and mitigate the impact of any executed spyware and information-stealing malware. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py-intelstringencode →
FAQ
py-intelstringencode is a Python package that provides encoding and decoding functionality for strings using Intel's proprietary algorithm. It is commonly used in data manipulation and encryption tasks.
The malicious code in py-intelstringencode was discovered by the Checkmarx security research team. They identified a package published by the EsqueleSquad group, which contained spyware and information-stealing malware.
The presence of the malicious code in py-intelstringencode can lead to the execution of spyware and information-stealing malware. This can result in unauthorized access to sensitive information, compromise of user privacy, and potential damage to affected systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the malicious code in py-intelstringencode.
If your system is affected by this vulnerability, it is crucial to immediately remove the py-intelstringencode package, scan your system for malware, and take appropriate actions to mitigate the impact. You should also update your security software and keep it up to date to prevent similar incidents in the future.
