Malicious code in python-binance (pypi)
Summary
MAL-2023-2108: Malicious code in python-biinance (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-binance is a Python wrapper for the Binance API, allowing users to interact with the Binance cryptocurrency exchange. It provides functions for accessing account information, trading, and market data. This vulnerability in python-binance involves the presence of malicious code in the package distributed via PyPi.
Vulnerability Detail
The attacker distributed over 900 malicious packages via PyPi, infecting local browsers with a malicious extension. This extension manipulates the clipboard and replaces crypto wallet addresses, potentially leading to the theft of funds. The specific package affected is python-binance, with the vulnerability introduced in version 0. The source of this information is Checkmarx, and the malicious package's SHA256 hash is d9ff96b34112795fae6523d6d376b51e11fc5166f8be37e46a5c53ea666df717.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall python-biinanceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by being cautious while installing packages from PyPi and verifying the integrity of the packages before use.
Conclusion
The python-binance package distributed via PyPi was found to contain malicious code that can manipulate the clipboard and replace crypto wallet addresses. To mitigate this vulnerability, it is crucial to update python-binance to a version that does not include the malicious code. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-biinance →
FAQ
Python-binance is a Python wrapper for the Binance API, enabling interaction with the Binance cryptocurrency exchange.
The malicious code infects local browsers with a malicious extension that manipulates the clipboard and replaces crypto wallet addresses, potentially leading to the theft of funds.
To fix this vulnerability, update python-binance to a version that does not contain the malicious code. Check for the latest version on PyPi and update your project's dependencies.
While no specific workaround is mentioned, users can mitigate the risk by being cautious while installing packages from PyPi and verifying package integrity.
For more information, you can refer to the Checkmarx report and the malicious package's details on the OSS Vulnerability Database.
