Malicious Code in selfverstringping (PyPI)
Summary
MAL-2023-6751: Malicious code in selfverstringping (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The selfverstringping package is an open-source Python package available on PyPI. It is used for self-verifying string pinging functionality. The package allows users to ping strings and verify their integrity. However, a vulnerability has been discovered in this package that involves the presence of malicious code.
Vulnerability Detail
The vulnerability, identified as MAL-2023-6751, originates from a group called EsqueleSquad. They have published nearly 6000 malicious PyPi and NPM packages, including selfverstringping. These packages execute spyware and information-stealing malware. The specific impact of this vulnerability on the selfverstringping package is not mentioned in the provided information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall selfverstringpingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned in the provided information. However, removing the selfverstringping package and ensuring the use of trusted packages can mitigate the risk of this vulnerability.
Conclusion
The selfverstringping package has been found to contain malicious code as part of a larger campaign by the EsqueleSquad group. It is recommended to remove this package from your project and replace it with a trusted alternative. Regularly reviewing and updating the packages used in your project is essential for maintaining security.
See every vulnerability recorded for selfverstringping →
FAQ
The selfverstringping package is a Python package available on PyPI that provides self-verifying string pinging functionality.
The specific impact of the vulnerability on the selfverstringping package is not mentioned in the provided information.
The vulnerability was discovered by Checkmarx, a security company specializing in supply chain security.
To fix this vulnerability, remove the selfverstringping package from your project and replace it with a trusted alternative. Regularly update and review the packages used in your project to avoid potential security risks.
There is no specific workaround mentioned in the provided information. However, removing the selfverstringping package and ensuring the use of trusted packages can mitigate the risk of this vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
