Malicious code in selfcpuintsplit (PyPI)
Summary
MAL-2023-5989: Malicious code in selfcpuintsplit (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The selfcpuintsplit package is an open-source Python package available on PyPI. It is used for CPU splitting in self-driving car simulations. The package allows users to split CPU resources efficiently for parallel processing. However, the package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The selfcpuintsplit package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. The malicious code in selfcpuintsplit can perform unauthorized activities on the user's system, such as collecting sensitive information and executing spyware. This poses a significant risk to the security and privacy of users who have installed this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfcpuintsplitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the selfcpuintsplit package and ensure that your system is free from any malicious code.
Conclusion
The selfcpuintsplit package has been compromised and contains malicious code that can lead to unauthorized activities on the user's system. It is recommended to remove the package and ensure the security of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for selfcpuintsplit →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including the malicious code in selfcpuintsplit.
No, updating to the latest version of selfcpuintsplit will not fix the vulnerability. The package itself has been compromised, and it is recommended to remove it entirely from your system.
Having the selfcpuintsplit package installed can lead to unauthorized activities on your system, such as information theft and the execution of spyware. This can result in the compromise of sensitive data and a breach of privacy.
Yes, there are alternative packages available for CPU splitting in self-driving car simulations. It is recommended to research and choose a package from a trusted source to ensure the security and integrity of your system.
To prevent similar vulnerabilities, it is crucial to regularly update and review the packages used in your projects. Additionally, consider using a package vulnerability monitoring tool like Vulert, which can provide real-time alerts for open-source vulnerabilities in your software.
