Malicious code in strgrand (PyPI)
Summary
MAL-2023-6813: Malicious code in strgrand (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The strgrand package is an open-source Python package available on PyPI. It provides functionality for generating random strings. The package is commonly used in various Python applications and projects.
Vulnerability Detail
A vulnerability has been identified in the strgrand package. The package was found to contain malicious code introduced by the EsqueleSquad group. This malicious code executes spyware and information-stealing malware. The code was discovered and reported by Checkmarx, a security company specializing in supply chain security. The malicious code poses a significant risk to systems that have installed or are using the affected version of the strgrand package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall strgrandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the affected package and take appropriate security measures as mentioned in the 'how_to_fix' section.
Conclusion
The strgrand package has been found to contain malicious code introduced by the EsqueleSquad group. This code can execute spyware and information-stealing malware, posing a significant risk to affected systems. It is crucial to remove the affected package and take appropriate security measures to mitigate the impact of this vulnerability. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for strgrand →
FAQ
The strgrand package is a Python package used for generating random strings.
The vulnerability was discovered by Checkmarx, a security company specializing in supply chain security. They identified the presence of malicious code in the strgrand package.
The malicious code in the strgrand package can execute spyware and information-stealing malware, potentially compromising sensitive data and system security.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities.
For further support and assistance in vulnerability remediation, you can contact info@devnack.com.
