Malicious code in pywool (PyPI) - MAL-2023-8591
Summary
MAL-2023-8591: Malicious code in pywool (PyPI). Affects pywool versions 1.0.0 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pywool is a Python package available on PyPI that provides functionality for working with woolen fabrics. It is commonly used by developers in the textile industry to automate various tasks related to wool processing. However, the package has been found to contain malicious code, posing a significant security risk to users.
Vulnerability Detail
The vulnerability, identified as MAL-2023-8591, originates from a malicious package campaign targeting developers. The payload is hidden using steganography, making it difficult to detect. Once installed, the package exfiltrates host information, potentially compromising sensitive data. The malicious code can be found in the pywool package on PyPI.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pywoolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the pywool package and following the recommended steps to mitigate the risk.
Conclusion
The presence of malicious code in the pywool package on PyPI poses a significant security risk to users. It is crucial to take immediate action by removing the package and replacing it with a trusted alternative. Regularly updating dependencies and using a reliable vulnerability monitoring tool like Vulert can help prevent similar vulnerabilities in the future. For further assistance, you can reach out to the Checkmarx team or contact DevNack.com.
See every vulnerability recorded for pywool →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the one related to pywool.
The malicious code in pywool can exfiltrate host information, potentially leading to unauthorized access to sensitive data. This can result in data breaches, compromised user privacy, and other security incidents.
Yes, the recommended fix is to remove the pywool package from your project and replace it with a trusted alternative. Regularly updating your dependencies and using a vulnerability monitoring tool like Vulert can also help prevent such vulnerabilities.
It is strongly advised against using the pywool package, even with precautions. The presence of malicious code poses a significant security risk, and it is best to switch to a trusted alternative to ensure the safety of your application and data.
If you have discovered this vulnerability or need further assistance, you can contact the Checkmarx team at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages. You can also reach out to info@devnack.com for additional support on vulnerability remediation.
