Malicious Code in supercv (PyPI)
Summary
MAL-2023-6842: Malicious code in supercv (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
supercv is a Python package available on PyPI that provides functionality for computer vision tasks. It is commonly used for image processing, object detection, and facial recognition. The package has gained popularity due to its ease of use and extensive documentation. However, a recent vulnerability has been discovered in supercv that exposes users to malicious code.
Vulnerability Detail
The vulnerability in supercv originates from a malicious package published on PyPI by the EsqueleSquad group. This package contains spyware and information-stealing malware. The malicious code can be executed when users install or update supercv, putting their systems at risk. The impact of this vulnerability can range from unauthorized access to sensitive information to complete system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supercvIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can temporarily disable or uninstall supercv until a fixed version is available. It is important to note that this workaround may impact any functionality or features that rely on supercv.
Conclusion
The presence of malicious code in supercv poses a significant risk to users. It is crucial to take immediate action to address this vulnerability by removing the affected version, updating dependencies, and monitoring for any signs of compromise. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for supercv →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this specific issue.
At the moment, it is recommended to avoid using any version of supercv until a clean and trusted version is released. Keep an eye on official announcements and security advisories for updates on the availability of a safe version.
The consequences of this vulnerability can be severe. It can lead to unauthorized access to sensitive information, data exfiltration, and even complete system compromise. It is crucial to address this vulnerability promptly to protect your system and data.
While it is recommended to remove the affected version of supercv, you can mitigate the risk by ensuring all other packages and dependencies are up to date. Regularly monitor for any suspicious activities or signs of compromise and take appropriate actions to secure your system.
If you come across any suspicious activities or believe your system has been compromised due to this vulnerability, it is important to report it to the appropriate authorities and seek professional assistance. Additionally, you can reach out to the developers of supercv and provide them with relevant details to aid in their investigation and remediation efforts.
