Malicious code in selfencodevmcontrol (PyPI)
Summary
MAL-2023-6065: Malicious code in selfencodevmcontrol (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
selfencodevmcontrol is a package available on PyPI that provides functionality for controlling virtual machines. It is commonly used in Python projects that involve virtualization. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The selfencodevmcontrol package, specifically version 0 and above, has been identified as containing malicious code. This vulnerability originates from a group called EsqueleSquad, who published nearly 6000 malicious PyPi and NPM packages. The malicious code can execute spyware and information-stealing malware, posing a significant risk to systems that use this package. The code can be found in the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfencodevmcontrolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the selfencodevmcontrol package and take the necessary steps to secure your system.
Conclusion
The selfencodevmcontrol package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is crucial to remove this package from your Python projects and take steps to secure your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for selfencodevmcontrol →
FAQ
This vulnerability can lead to the execution of spyware and information-stealing malware on your system, potentially compromising sensitive data and compromising the security of your system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply enter your Pipfile.lock file, and Vulert will provide real-time alerts for open-source vulnerabilities.
If your system is affected by this vulnerability, it is recommended to immediately remove the selfencodevmcontrol package, scan your system for spyware or malware, and ensure that you have up-to-date antivirus software installed.
Yes, you can continue using other packages in your project. However, it is crucial to review the list of installed packages and verify the integrity of each package to ensure they are not compromised.
To prevent similar vulnerabilities, it is essential to regularly update your packages to the latest versions, use reputable sources for package installation, and perform security scans on your system to detect any potential threats.
