Malicious code in tpccproof (PyPI)
Summary
MAL-2023-6939: Malicious code in tpccproof (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpccproof is a package available on PyPI that is used for testing and benchmarking database systems. It provides a set of tools and utilities to simulate the workload of an online transaction processing (OLTP) system. The package is widely used by developers and organizations to evaluate the performance and scalability of their database systems. However, a recent security incident has revealed that a malicious version of tpccproof was published on PyPI, containing spyware and information-stealing malware.
Vulnerability Detail
The malicious code in tpccproof poses a significant security risk to users who have installed the affected package. The code is designed to execute spyware and steal sensitive information from the infected system. This can lead to unauthorized access to personal and confidential data, compromising the security and privacy of users. The origin of this vulnerability can be traced back to the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages, including tpccproof. The malicious code was introduced in version 0 of tpccproof and went undetected until it was discovered by the Checkmarx security team. The code can be downloaded from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpccproofIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section.
Conclusion
The presence of malicious code in tpccproof highlights the importance of maintaining a secure software supply chain. It is crucial for developers and organizations to regularly update their packages, verify their integrity, and scan for vulnerabilities. By following best practices and staying vigilant, users can protect themselves from such security threats. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpccproof →
FAQ
You can check the version of tpccproof installed on your system by running the following command:
pip show tpccproof
If you have the affected version of tpccproof installed, it is recommended to immediately remove it from your system and follow the steps mentioned in the 'how_to_fix' section.
Yes, you can trust the latest version of tpccproof from PyPI as long as you download it from the official PyPI repository. It is important to verify the package's integrity by checking its cryptographic hash or using a package manager that performs automatic verification.
To ensure the security of your Python packages, it is recommended to follow best practices such as regularly updating your packages to the latest versions, using package managers that perform automatic verification, and scanning your system for vulnerabilities using tools like Vulert.
If your system has been infected by the malicious code in tpccproof, it is important to take immediate action to mitigate the damage. This may include restoring your system from a clean backup, running malware removal tools, and changing passwords for sensitive accounts.
