Malicious code in tpcontrolstr (PyPI)
Summary
MAL-2023-6956: Malicious code in tpcontrolstr (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpcontrolstr package is an open-source Python package available on PyPI. It is used for controlling and managing TP control systems. The package provides various functionalities for interacting with TP control devices. However, the package has been found to contain malicious code, which poses a security risk to users who install and use it.
Vulnerability Detail
The tpcontrolstr package has been identified as part of a larger group of nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group. These packages execute spyware and information-stealing malware. The specific vulnerability in tpcontrolstr allows the execution of malicious code, potentially leading to unauthorized access, data theft, and other malicious activities. The malicious code can be found in the package's source code and can be triggered when the package is installed or used.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpcontrolstrIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the tpcontrolstr package and replace it with a trusted alternative.
Conclusion
The tpcontrolstr package on PyPI has been found to contain malicious code, posing a significant security risk to users. It is recommended to remove the package from your project and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is essential to ensure they are free from known vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpcontrolstr →
FAQ
tpcontrolstr is a Python package used for controlling and managing TP control systems.
The tpcontrolstr package contains malicious code that can be executed when the package is installed or used. This code can lead to unauthorized access, data theft, and other malicious activities.
This vulnerability was discovered by the Checkmarx team.
Yes, there are nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group that execute spyware and information-stealing malware.
To protect your software, it is crucial to regularly update and review the packages used in your project, ensuring they are from trusted sources and free from any known vulnerabilities. Tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
