Malicious Code in tpcontrolint (PyPI)
Summary
MAL-2023-6945: Malicious code in tpcontrolint (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpcontrolint is a package available on PyPI that provides functionality for controlling TP-Link smart devices. It is commonly used in Python projects to interact with TP-Link devices and manage their settings. However, a recent vulnerability has been discovered in tpcontrolint, which involves the presence of malicious code in the package.
Vulnerability Detail
The vulnerability in tpcontrolint is a result of the package being compromised by the EsqueleSquad group. They published nearly 6000 malicious PyPi and NPM packages, including tpcontrolint, which execute spyware and information-stealing malware. This malicious code can potentially compromise the security and privacy of systems that use tpcontrolint. The malicious packages can be identified by their origins, and the specific malicious version of tpcontrolint has a SHA256 hash of c1edc71ff6530c95d394ab94be86a548f44750157f97ae6e8efe8c3f0449c867.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpcontrolintIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to regularly update and review the dependencies in your project to ensure they are secure and free from any known vulnerabilities.
Conclusion
The presence of malicious code in tpcontrolint poses a significant security risk to systems that use this package. It is crucial to promptly update your project's dependencies and remove the affected version of tpcontrolint to mitigate the risk of compromise. Regularly reviewing and updating dependencies is a good practice to ensure the security and integrity of your software.
See every vulnerability recorded for tpcontrolint →
FAQ
You can check your project's dependency tree or package lock file to see if it includes the malicious version of tpcontrolint. Alternatively, you can use tools like Vulert (https://vulert.com) to scan your project and identify any vulnerable dependencies.
Using the malicious version of tpcontrolint can expose your system to spyware and information-stealing malware. This can result in unauthorized access to sensitive data, compromised privacy, and potential damage to your system.
The best mitigation is to remove the affected version of tpcontrolint from your project and replace it with a trusted version. Regularly updating and reviewing your project's dependencies can also help mitigate the risk of using compromised packages.
The malicious version of tpcontrolint has been identified and its SHA256 hash is c1edc71ff6530c95d394ab94be86a548f44750157f97ae6e8efe8c3f0449c867. It is recommended to avoid using this version and instead use a trusted version of tpcontrolint.
If you have any further questions or need assistance with vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and support in addressing this vulnerability.
