Malicious code in py-stringrandom (pypi)
Summary
MAL-2023-5638: Malicious code in py-stringrandom (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The py-stringrandom package is an open-source Python package available on PyPI. It provides functionality for generating random strings. The package is widely used in various Python applications and projects.
Vulnerability Detail
A vulnerability has been identified in the py-stringrandom package. The package was found to contain malicious code introduced by the EsqueleSquad group. The malicious code executes spyware and information-stealing malware. This poses a significant security risk to any application or project that includes the py-stringrandom package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall py-stringrandomIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. The best course of action is to remove the py-stringrandom package and replace it with a trusted alternative.
Conclusion
The py-stringrandom package has been found to contain malicious code introduced by the EsqueleSquad group. This poses a significant security risk to any application or project that includes the package. It is recommended to remove the py-stringrandom package and replace it with a trusted alternative. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for py-stringrandom →
FAQ
The malicious code in py-stringrandom can execute spyware and information-stealing malware, potentially compromising sensitive data in your application.
The recommended fix is to remove the py-stringrandom package and replace it with a trusted alternative.
You can use tools like Vulert (https://vulert.com) to monitor and alert for open-source vulnerabilities in your software. Vulert can analyze your Pipfile.lock and provide real-time vulnerability information.
There have been reports of the EsqueleSquad group introducing malicious code into various PyPi and NPM packages, including py-stringrandom. It is essential to take immediate action to mitigate the risk.
While PyPI is generally a reliable source for open-source packages, it is crucial to regularly review and verify the integrity of the packages you use. Stay updated with security advisories and consider using tools like Vulert to ensure the safety of your software.
