Malicious code in toolmine (PyPI)
Summary
MAL-2023-6885: Malicious code in toolmine (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Toolmine is a package available on PyPI that provides various tools and utilities for developers. It is commonly used in Python projects for tasks such as data manipulation, file handling, and system operations. However, the package has been found to contain malicious code, which poses a significant security risk to projects that depend on it.
Vulnerability Detail
The toolmine package from PyPI has been compromised by a group known as EsqueleSquad. They have published nearly 6000 malicious packages on PyPI and NPM, including toolmine, that execute spyware and information-stealing malware. This malicious code can potentially compromise the security and privacy of systems that use the affected package. The malicious code can be downloaded from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall toolmineIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps to fix the issue and protect your system from potential harm.
Conclusion
The toolmine package from PyPI has been compromised by malicious code published by EsqueleSquad. This poses a significant security risk to projects that depend on the package. It is crucial to remove the package and any dependencies, scan your system for compromise, and take appropriate actions to protect your project and data. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for toolmine →
FAQ
If your project depends on the toolmine package, it is at risk of being compromised by the malicious code. This can lead to unauthorized access, data theft, and other security breaches.
Yes, you can continue using other packages from PyPI as long as they are not part of the list of known malicious packages published by EsqueleSquad. It is crucial to regularly update your packages and stay informed about any security advisories.
You can use tools like Vulert (https://vulert.com) to scan your project and check for any known vulnerabilities, including this specific issue. Vulert analyzes your Pipfile.lock to provide real-time alerts for open-source vulnerabilities.
If your project is affected by this vulnerability, it is recommended to follow the steps outlined in the 'how_to_fix' section of this report. Additionally, you should consider conducting a thorough security audit to identify any other potential vulnerabilities.
To prevent similar vulnerabilities, it is crucial to regularly update your packages, use reputable sources for package installation, and stay informed about any security advisories or reports of malicious packages. Additionally, consider implementing security measures such as code reviews, vulnerability scanning, and secure coding practices.
