Malicious code in selfencodegame (PyPI)
Summary
MAL-2023-6047: Malicious code in selfencodegame (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The selfencodegame package is an open-source Python package available on PyPI. It is designed to provide functionality for self-encoding games. This package allows users to create and play self-encoding games, where the game logic and assets are encoded within the game itself. The package has been found to contain malicious code, which poses a security risk to users who install and use it.
Vulnerability Detail
The selfencodegame package has been identified as containing malicious code. This code was introduced in version 0 of the package and was discovered by Checkmarx. The malicious code is part of a larger campaign by the EsqueleSquad group, who have published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific impact of the malicious code in selfencodegame may vary, but it poses a significant risk to the security and privacy of users who install and use the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfencodegameIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The selfencodegame package on PyPI has been found to contain malicious code, posing a significant security risk to users. It is recommended to remove the package from your Python environment and regularly review and update the packages you use. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for selfencodegame →
FAQ
The selfencodegame package is an open-source Python package that allows users to create and play self-encoding games.
The malicious code in the selfencodegame package was discovered by Checkmarx as part of their ongoing research into malicious PyPi and NPM packages.
The malicious code in selfencodegame can execute spyware and information-stealing malware, posing a significant risk to the security and privacy of users.
To protect yourself, it is recommended to remove the selfencodegame package from your Python environment and regularly update and review the packages you use in your projects.
There are no known workarounds for this vulnerability. It is best to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
