Malicious code in tooltool (PyPI)
Summary
MAL-2023-6899: Malicious code in tooltool (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tooltool is a PyPI package that provides a set of tools for various purposes. It is widely used in Python projects for its functionality and ease of use. However, the package has been found to contain malicious code, which poses a significant security risk to users.
Vulnerability Detail
The tooltool package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in tooltool allows the execution of unauthorized code, leading to potential data breaches, unauthorized access, and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tooltoolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
The tooltool package has been compromised by malicious code, posing a significant security risk to users. It is crucial to update to the latest secure version of the package to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tooltool →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The malicious code in the tooltool package can lead to various risks, including data breaches, unauthorized access, and the installation of spyware and information-stealing malware. It is crucial to address this vulnerability promptly to mitigate these risks.
Yes, the maintainers of the tooltool package have released a patched version that removes the malicious code. It is essential to update to the latest version to ensure your application is not affected.
There have been reports of the EsqueleSquad group publishing malicious packages, including the compromised tooltool package. While specific instances of exploitation may not be publicly known, it is crucial to address this vulnerability to prevent any potential harm.
You can reach out to the maintainers of the tooltool package by contacting supplychainsecurity@checkmarx.com or visiting their website at https://bit.ly/checkmarx-malicious-packages. They can provide further guidance and support on vulnerability remediation.
