Malicious code in supergrand (PyPI)
Summary
MAL-2023-6845: Malicious code in supergrand (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Supergrand is a Python package available on PyPI. It is designed to provide a comprehensive set of tools for data analysis and visualization. The package has gained popularity due to its ease of use and extensive functionality. However, it has recently been discovered that the package contains malicious code, which poses a significant security risk to users.
Vulnerability Detail
The vulnerability in supergrand stems from the inclusion of malicious code in the package. This code has been injected by the EsqueleSquad group, who have published nearly 6000 malicious PyPi and NPM packages. The malicious code is designed to execute spyware and information-stealing malware. This poses a serious threat to the security and privacy of users who install and use the affected version of supergrand.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supergrandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps to fix the issue and mitigate any potential damage caused by the malicious code.
Conclusion
The presence of malicious code in supergrand poses a significant security risk to users. It is crucial to take immediate action to remove the affected version and mitigate any potential damage. Regularly updating packages and following best practices for package installation can help prevent similar vulnerabilities in the future. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for supergrand →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply enter your application's Pipfile.lock, and Vulert will provide real-time alerts for any open-source vulnerabilities, including this one.
The malicious code in supergrand can execute spyware and information-stealing malware, compromising the security and privacy of users. This can lead to unauthorized access to sensitive data, financial loss, and other serious consequences.
Yes, the recommended fix is to remove the affected version of supergrand from your system and scan for any signs of malware or spyware. It is crucial to regularly update your packages and only install packages from trusted sources to prevent similar vulnerabilities.
Yes, you can continue using supergrand by ensuring that you have the latest, non-malicious version installed. It is important to update your packages regularly to stay protected from security vulnerabilities.
If you have any further questions or need assistance with vulnerability remediation, you can contact info@devnack.com. They will provide support and guidance to help you address the issue.
