Malicious Code in supersuper (PyPI)
Summary
MAL-2023-6861: Malicious code in supersuper (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
supersuper is a Python package available on PyPI. It is used for [provide brief description of the package's functionality and key attributes]. However, supersuper is currently vulnerable to a malicious code injection.
Vulnerability Detail
The vulnerability in supersuper is a result of the presence of a malicious code in the package. This code was introduced in version 0 and is associated with the source checkmarx. The malicious code can execute spyware and information-stealing malware. The package has been identified as part of the EsqueleSquad group's campaign, which published nearly 6000 malicious PyPi and NPM packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supersuperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
The presence of malicious code in supersuper poses a significant security risk. It is crucial to update the package to a secure version as soon as possible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for supersuper →
FAQ
supersuper is a Python package available on PyPI. It is used for [provide brief description of the package's functionality and key attributes].
The malicious code injected into supersuper can execute spyware and information-stealing malware, posing a risk to the users of the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a fix is available for supersuper. It is recommended to update the package to the latest version, which should be free from the malicious code.
This vulnerability was discovered by Checkmarx, a security company specializing in supply chain security. You can contact them at supplychainsecurity@checkmarx.com for more information.
