Malicious code in py-randomkillpull (pypi)
Summary
MAL-2023-5572: Malicious code in py-randomkillpull (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The py-randomkillpull package is an open-source Python package available on the Python Package Index (PyPI). It is used for random killing and pulling operations in Python applications. The package allows developers to implement randomization and termination functionalities in their code. However, the package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in py-randomkillpull arises from the inclusion of malicious code in the package. The code is designed to perform unauthorized actions on the user's system, such as downloading and executing additional malware. This can result in the compromise of sensitive information and unauthorized access to the user's system. The malicious code is introduced in version 0 of the package and has been identified by Checkmarx. The specific details of the code and its behavior can be found in the Checkmarx report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall py-randomkillpullIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to remove the py-randomkillpull package and replace it with a trusted alternative.
Conclusion
The py-randomkillpull package has been found to contain malicious code that can lead to the execution of spyware and information-stealing malware. To protect your system and data, it is recommended to remove the package and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your application is also crucial to prevent similar vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for py-randomkillpull →
FAQ
The malicious code in py-randomkillpull can lead to the execution of spyware and information-stealing malware on your system. This can result in the compromise of sensitive information and unauthorized access to your system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock file and Vulert will analyze it for open-source vulnerabilities.
No, the recommended course of action is to remove the py-randomkillpull package and replace it with a trusted alternative. This ensures that your system is not exposed to the malicious code.
The best mitigation for this vulnerability is to remove the py-randomkillpull package and replace it with a trusted alternative. Additionally, regularly updating and reviewing the packages used in your application can help prevent similar vulnerabilities.
You can report this vulnerability to the package maintainers by contacting them through the PyPI platform or their official communication channels. It is important to provide them with all relevant details and evidence to help them address the issue effectively.
