Malicious code in splitintel (PyPI)
Summary
MAL-2023-6805: Malicious code in splitintel (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Splitintel is a package available on PyPI that provides functionality for splitting intelligence data. It is commonly used in data analysis and intelligence gathering applications. However, the package has been found to contain malicious code, which poses a significant security risk to users.
Vulnerability Detail
The splitintel package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in splitintel allows attackers to gain unauthorized access to sensitive information, potentially leading to data breaches and privacy violations. The malicious code can be triggered when using the affected package, compromising the security and integrity of the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall splitintelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the affected package and following the recommended steps to mitigate the risk.
Conclusion
The presence of malicious code in the splitintel package poses a significant security risk to users. It is crucial to take immediate action by removing the affected package, updating the package manager, and performing a security audit of your project. Regular monitoring for vulnerabilities and suspicious activities is also recommended. For further support and guidance on vulnerability remediation, you can contact the Devnack support team at DevNack.com.
See every vulnerability recorded for splitintel →
FAQ
You can check your project's dependencies and package manager configuration to identify if the splitintel package is being used. Additionally, you can use vulnerability monitoring tools like Vulert to scan your project and detect any vulnerable packages.
The malicious code in the splitintel package can lead to unauthorized access to sensitive information, data breaches, and privacy violations. Attackers may be able to steal valuable data, compromise user accounts, or gain control over the affected system.
Yes, the recommended fix is to remove the splitintel package from your project and update your package manager. It is also crucial to perform a security audit of your project to ensure no other compromised packages are present.
Yes, you can continue using other packages from PyPI as long as they are not compromised or vulnerable. It is essential to regularly update your packages and monitor for any security advisories or vulnerabilities.
If you have identified this vulnerability in the splitintel package or need further assistance, you can report it to the package maintainers or reach out to the Devnack support team at info@devnack.com.
