Malicious Code in supergame (PyPI)
Summary
MAL-2023-6843: Malicious code in supergame (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
supergame is a Python package available on PyPI. It is a popular game library used for developing interactive games. The package provides various functionalities and features to simplify game development. However, it has been discovered that the supergame package contains malicious code.
Vulnerability Detail
The supergame package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in the supergame package allows the execution of malicious code, which can lead to unauthorized access, data theft, and potential harm to the user's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supergameIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the latest non-compromised version as soon as possible.
Conclusion
The supergame package on PyPI has been compromised by the EsqueleSquad group, leading to the execution of malicious code. To ensure the security of your system, it is crucial to update the package to the latest non-compromised version. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for supergame →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The malicious code in the supergame package can lead to unauthorized access to sensitive data, such as user credentials or personal information. It can also execute additional malware on the user's system, potentially causing further harm or compromising the system's security.
Yes, the maintainers of the supergame package have identified and removed the malicious code. It is crucial to update to the latest non-compromised version to ensure your system is secure.
There have been reports of the EsqueleSquad group actively exploiting this vulnerability. It is recommended to update the package immediately to mitigate any potential risks.
If you notice any suspicious activity or believe your system has been compromised due to this vulnerability, it is recommended to report it to the package maintainers and your system's security team. Additionally, you can reach out to supplychainsecurity@checkmarx.com for further assistance.
