Malicious code in tpcontrolloadcv (PyPI)
Summary
MAL-2023-6948: Malicious code in tpcontrolloadcv (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpcontrolloadcv package is an open-source Python package available on PyPI. It is used for controlling and loading CV (computer vision) models. This package allows developers to easily integrate computer vision capabilities into their applications. However, the package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The tpcontrolloadcv package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages include spyware and information-stealing malware. The specific vulnerability in tpcontrolloadcv allows the execution of the malicious code, putting users' systems and data at risk. The malicious code can potentially gather sensitive information, compromise user privacy, and lead to unauthorized access to systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpcontrolloadcvIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the tpcontrolloadcv package and replace it with a trusted alternative.
Conclusion
The tpcontrolloadcv package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware. It is crucial to remove this package from your project and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is essential to ensure they are free from vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tpcontrolloadcv →
FAQ
tpcontrolloadcv is a Python package used for controlling and loading computer vision models.
The malicious code in tpcontrolloadcv can execute spyware and information-stealing malware, potentially compromising your system's security and privacy.
To fix the vulnerability, remove the tpcontrolloadcv package from your project and replace it with a trusted alternative. Regularly update and review the packages used in your project to ensure they are free from vulnerabilities.
There is no known workaround for this vulnerability. It is crucial to remove the tpcontrolloadcv package and replace it with a trusted alternative.
To prevent similar vulnerabilities, regularly update and review the packages used in your project. Consider using a dependency management tool like Vulert (https://vulert.com) to monitor and alert for open-source vulnerabilities in your software.
