Malicious Code in supervirtual (PyPI)
Summary
MAL-2023-6865: Malicious code in supervirtual (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
supervirtual is a package available on PyPI that provides virtualization capabilities. It allows users to create and manage virtual environments for Python projects. The package is widely used in the Python ecosystem for development and testing purposes. However, it has been discovered that a malicious version of supervirtual has been published on PyPI, containing spyware and information-stealing malware.
Vulnerability Detail
The malicious code in supervirtual poses a significant security risk to users who unknowingly install the compromised package. Once installed, the malware can collect sensitive information, such as login credentials, personal data, and system information. It can also execute unauthorized actions on the infected system, potentially leading to further compromise. The origin of this vulnerability is traced back to the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall supervirtualIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section to remove the compromised package and mitigate any potential damage.
Conclusion
The presence of malicious code in supervirtual poses a significant security risk to users. It is crucial to take immediate action to remove the compromised package and mitigate any potential damage. Regularly updating dependencies and using trusted sources for package installation can help prevent similar vulnerabilities in the future. For further support on vulnerability remediation, reach out to DevNack.com.
See every vulnerability recorded for supervirtual →
FAQ
You can check if you have the malicious version of supervirtual installed by running the following command:
$ pip show supervirtual
If the version displayed matches the compromised version, it means you have the malicious package installed.
If you have the malicious version of supervirtual installed, it is recommended to immediately remove it from your system. You can do this by running the following command:
$ pip uninstall supervirtual
Yes, the malicious code in supervirtual can harm your system by collecting sensitive information and executing unauthorized actions. It is important to take immediate action to remove the compromised package and mitigate any potential damage.
To protect yourself from similar vulnerabilities in the future, it is crucial to only install packages from trusted sources. Regularly update your dependencies to ensure you are using the latest, secure versions of the packages. Additionally, consider using a vulnerability monitoring tool like Vulert, which can alert you in real-time for open-source vulnerabilities in your software.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the specific vulnerability in supervirtual.
