Malicious code in tpcpupingreplace (PyPI)
Summary
MAL-2023-6968: Malicious code in tpcpupingreplace (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpcpupingreplace package is an open-source Python package available on PyPI. It is used for replacing text patterns in files. The package allows users to specify a pattern and replacement text, and it performs the replacement operation on the specified files. The package is widely used in various Python projects.
Vulnerability Detail
A vulnerability has been discovered in the tpcpupingreplace package. The package was found to contain malicious code introduced by the Checkmarx group. This malicious code can execute spyware and information-stealing malware on systems where the package is installed. The malicious code was added to the package in a recent version, making it a potential threat to any project that uses the affected version of tpcpupingreplace. The malicious code can be triggered when the package is used to replace text patterns in files.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpcpupingreplaceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the affected version of tpcpupingreplace and replace it with a trusted version as soon as possible.
Conclusion
The tpcpupingreplace package has been found to contain malicious code introduced by the Checkmarx group. This code can execute spyware and information-stealing malware on systems where the package is installed. To protect your project and system, it is crucial to remove the affected version of tpcpupingreplace and replace it with a trusted version. Additionally, it is recommended to scan your system for any signs of malware or spyware and keep your security software up to date. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpcpupingreplace →
FAQ
The malicious code was introduced in version 0 of tpcpupingreplace. Any version equal to or greater than 0 is potentially affected.
You can check your project's dependencies and their versions to determine if the affected version of tpcpupingreplace is being used. Additionally, you can use tools like Vulert (https://vulert.com) to scan your project and identify any vulnerable dependencies.
The malicious code in tpcpupingreplace can execute spyware and information-stealing malware on systems where the package is installed. This can lead to unauthorized access to sensitive information, data breaches, and other security incidents.
No, the malicious code is still present in the affected version of tpcpupingreplace. It is recommended to remove this version from your project and use a trusted version instead.
If your project is using the affected version of tpcpupingreplace, you should immediately remove it from your project's dependencies and replace it with a trusted version. You should also scan your system for any signs of malware or spyware and take appropriate actions to remove them.
