Malicious code in supermc (PyPI)
Summary
MAL-2023-6852: Malicious code in supermc (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The supermc package is an open-source Python package available on PyPI. It is designed to provide functionality for managing and interacting with Minecraft servers. The package allows users to perform various operations such as starting, stopping, and monitoring Minecraft servers. Unfortunately, the package has been found to contain malicious code that can execute spyware and information-stealing malware.
Vulnerability Detail
The malicious code in the supermc package originates from a group called EsqueleSquad. They have published nearly 6000 malicious packages on PyPI and NPM, targeting unsuspecting users. The code included in the supermc package can compromise the security and privacy of users by executing spyware and stealing sensitive information. This vulnerability poses a significant risk to anyone who installs and uses the supermc package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supermcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the supermc package entirely from your system to mitigate the risk of malicious code execution.
Conclusion
The presence of malicious code in the supermc package poses a significant risk to users who install and use it. It is crucial to uninstall the package immediately and take necessary precautions to ensure the security and privacy of your system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for supermc →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the malicious code in the supermc package.
No, it is not recommended to use the supermc package even if it is updated. The package has been compromised and contains malicious code that can compromise your system's security and privacy. It is best to find an alternative package or solution for managing Minecraft servers.
Yes, you can find a list of the malicious packages published by EsqueleSquad on the GitHub repository of the Malicious Packages project (https://github.com/ossf/malicious-packages). The repository provides details about the origins, vulnerabilities, and affected packages.
If you have already installed the supermc package, it is crucial to uninstall it immediately. Additionally, scan your system for any signs of malicious activity or compromised security. Consider changing any passwords or sensitive information that may have been exposed.
To prevent similar vulnerabilities, it is essential to follow best practices for package management. Regularly update and review the packages you install, verify the authenticity and reputation of package maintainers, and consider using security tools like Vulert to monitor and alert for open-source vulnerabilities in your software.
