Malicious code in toollgtb (PyPI)
Summary
MAL-2023-6881: Malicious code in toollgtb (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The toollgtb package is an open-source Python package available on PyPI. It is designed to provide specific functionality to users. However, this package has been found to contain malicious code, making it a potential security risk for users who install and use it.
Vulnerability Detail
The toollgtb package has been identified as part of a larger group of nearly 6000 malicious PyPI and NPM packages published by the EsqueleSquad group. These packages execute spyware and information-stealing malware, posing a significant threat to the security and privacy of users. The specific vulnerability in toollgtb allows the execution of malicious code, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall toollgtbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. The best course of action is to remove the toollgtb package and follow the recommended steps to fix the issue.
Conclusion
The toollgtb package on PyPI has been found to contain malicious code as part of a larger group of malicious packages. This vulnerability poses a significant risk to users, potentially leading to unauthorized access and data theft. It is crucial to remove the toollgtb package and take appropriate measures to mitigate the impact. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for toollgtb →
FAQ
The toollgtb package becomes vulnerable when it is installed from PyPI and includes the malicious code introduced by the EsqueleSquad group.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data theft, and the execution of malicious activities on the affected system.
You can use tools like Vulert (https://vulert.com) to monitor and alert in real-time for open-source vulnerabilities in your software. Vulert can analyze your Pipfile.lock and provide information on whether your application is affected by this vulnerability.
While the toollgtb package has been identified as containing malicious code, it does not necessarily mean that all packages on PyPI are compromised. However, it is always recommended to exercise caution and regularly update your packages to mitigate potential security risks.
For more information about this vulnerability and its impact, you can refer to the Checkmarx report (https://bit.ly/checkmarx-malicious-packages) or reach out to supplychainsecurity@checkmarx.com.
