Malicious code in selfverpulled (PyPI)
Summary
MAL-2023-6746: Malicious code in selfverpulled (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The selfverpulled package is an open-source Python package available on PyPI. It is designed to provide self-verification functionality for pulled data. The package allows users to verify the integrity and authenticity of data obtained from external sources. However, a vulnerability has been discovered in the package that allows the execution of malicious code.
Vulnerability Detail
The vulnerability in selfverpulled arises from the inclusion of malicious code in the package. The code is part of a larger campaign by the EsqueleSquad group, who have published nearly 6000 malicious PyPi and NPM packages. These packages contain spyware and information-stealing malware. The specific impact of this vulnerability on selfverpulled is not detailed in the provided information, but it is crucial to address it promptly to prevent potential compromise of user data and systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfverpulledIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned in the provided information. However, as a general best practice, users can consider temporarily removing or disabling the selfverpulled package from their projects until a secure version is released. This can help mitigate the risk of potential exploitation.
Conclusion
The presence of malicious code in the selfverpulled package poses a significant security risk. It is crucial for users to update to a secure version as soon as it becomes available. Regularly monitoring for security updates and following best practices for dependency management can help mitigate the risk of such vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for selfverpulled →
FAQ
selfverpulled is an open-source Python package available on PyPI that provides self-verification functionality for pulled data.
The vulnerability in selfverpulled is the inclusion of malicious code in the package, which can lead to the execution of spyware and information-stealing malware.
This vulnerability was discovered by Checkmarx, a security research group.
To fix this vulnerability, it is recommended to update the selfverpulled package to a version that does not contain the malicious code. Keep an eye on official announcements from the package maintainers for a patched version.
While no specific workaround is mentioned, users can consider temporarily removing or disabling the selfverpulled package from their projects until a secure version is released.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
