Malicious code in simple-api-py (PyPI)
Summary
MAL-2024-6011: Malicious code in simple-api-py (PyPI). Affects simple-api-py versions 1.2.0 – 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The simple-api-py package is an open-source Python package available on PyPI. It provides functionality for building and interacting with simple APIs. The package is widely used in various Python projects and offers a convenient way to create and manage APIs. However, a recent vulnerability has been discovered in the package, exposing users to potential security risks.
Vulnerability Detail
The vulnerability, identified as MAL-2024-6011, involves the presence of malicious code in versions 1.2.0 and 1.2.1 of the simple-api-py package. The malicious code was injected into the package's source code and distributed through PyPI. The code can potentially execute arbitrary commands on the affected system, leading to unauthorized access, data breaches, or other malicious activities. Users who have installed or are using these specific versions of the package are at risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall simple-api-pyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malicious code in versions 1.2.0 and 1.2.1 of the simple-api-py package poses a significant security risk to users. It is crucial to update to a secure version to protect against potential unauthorized access and data breaches. The maintainers of the package have released a patched version that removes the malicious code. Additionally, it is recommended to regularly monitor for security updates and vulnerabilities in open-source packages to ensure the overall security of your software.
See every vulnerability recorded for simple-api-py →
FAQ
You can check the version of simple-api-py installed in your environment by running the following command: pip show simple-api-py
No, only versions 1.2.0 and 1.2.1 of simple-api-py are affected by this vulnerability. It is recommended to update to a secure version.
Yes, the malicious code can be executed remotely if an attacker is able to exploit the vulnerability. It is crucial to update to a secure version to mitigate this risk.
Yes, the maintainers of PyPI have removed the malicious versions of simple-api-py from the repository. However, it is still important to update to a secure version to ensure your environment is protected.
At this time, there is no evidence of exploitation in the wild. However, it is strongly advised to update to a secure version as a precautionary measure.
