Malicious code in py-stringrandkill (pypi)
Summary
MAL-2023-5637: Malicious code in py-stringrandkill (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The py-stringrandkill package is an open-source Python package available on PyPI. It provides functionality for generating random strings. The package is commonly used in various Python projects and applications. However, the package has been found to contain malicious code, which poses a security risk to users who install and use it.
Vulnerability Detail
The py-stringrandkill package has been identified as part of a larger group of nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group. These packages execute spyware and information-stealing malware. The specific vulnerability in py-stringrandkill allows the execution of malicious code, potentially leading to unauthorized access, data theft, and other malicious activities. Users who install this package are at risk of compromising the security and integrity of their systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall py-stringrandkillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The py-stringrandkill package on PyPI has been found to contain malicious code, posing a significant security risk to users. It is crucial to remove this package from your Python environment to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for py-stringrandkill →
FAQ
py-stringrandkill is a Python package available on PyPI that provides functionality for generating random strings.
The malicious code in py-stringrandkill can execute spyware and information-stealing malware, potentially leading to unauthorized access, data theft, and other malicious activities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will alert you in real-time for any open-source vulnerabilities, including this one.
Yes, the recommended fix is to remove the py-stringrandkill package from your Python environment by running the command 'pip uninstall py-stringrandkill'.
For more information about this vulnerability and its impact, you can contact supplychainsecurity@checkmarx.com or visit https://bit.ly/checkmarx-malicious-packages.
