Malicious code in selfstrreplace (PyPI)
Summary
MAL-2023-6650: Malicious code in selfstrreplace (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The selfstrreplace package is an open-source Python package available on PyPI. It is designed to provide string replacement functionality in Python applications. This package is vulnerable to a malicious code injection issue.
Vulnerability Detail
The selfstrreplace package has been found to contain malicious code. This code was introduced in version 0 of the package and was discovered by the Checkmarx security team. The malicious code is capable of executing spyware and information-stealing malware. The specific details of the malware and its impact are not provided in the vulnerability report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfstrreplaceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned in the vulnerability report. However, as a general best practice, it is recommended to follow secure coding practices, such as input validation and sanitization, to mitigate the risk of code injection vulnerabilities.
Conclusion
The selfstrreplace package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is recommended to remove this package from your Python environment and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your application is crucial to ensure they are free from known vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for selfstrreplace →
FAQ
The impact of this vulnerability is not explicitly mentioned in the vulnerability report. However, since the malicious code is capable of executing spyware and information-stealing malware, it can potentially lead to unauthorized access to sensitive information and compromise the security of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The Vulert Playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Yes, the recommended fix for this vulnerability is to remove the selfstrreplace package from your Python environment and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your application is also crucial to ensure they are free from known vulnerabilities.
This vulnerability was discovered by the Checkmarx security team. They identified nearly 6000 malicious PyPi and NPM packages, including the selfstrreplace package, that were executing spyware and information-stealing malware.
You can contact the Checkmarx security team by sending an email to supplychainsecurity@checkmarx.com or by visiting their website at https://bit.ly/checkmarx-malicious-packages.
