Malicious code in tpedpingpull (PyPI)
Summary
MAL-2023-7004: Malicious code in tpedpingpull (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpedpingpull is a package available on PyPI that provides functionality related to pinging and pulling data. It is commonly used in Python projects for network monitoring and data retrieval tasks. However, this package has been found to contain malicious code.
Vulnerability Detail
The tpedpingpull package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in tpedpingpull allows unauthorized code execution and potential data exfiltration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpedpingpullIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the malicious package and replacing it with a secure alternative.
Conclusion
The tpedpingpull package available on PyPI has been found to contain malicious code, potentially leading to unauthorized code execution and data exfiltration. It is crucial to remove this package from your project and replace it with a trusted alternative. Regularly reviewing and updating the packages used in your project is essential to maintain security. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpedpingpull →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, you can find the list of malicious packages, including tpedpingpull, on the GitHub repository of the Malicious Packages project maintained by the Open Source Security Foundation (OSSF). The repository URL is https://github.com/ossf/malicious-packages.
This vulnerability can lead to unauthorized code execution and data exfiltration. The malicious code within tpedpingpull can compromise the security and integrity of your project, potentially exposing sensitive information to unauthorized parties.
While specific instances of exploitation may not be publicly documented, the presence of malicious code in the tpedpingpull package indicates a significant security risk. It is crucial to address this vulnerability promptly to mitigate any potential harm.
If you have discovered this vulnerability or need further assistance, you can contact the finder, Checkmarx, via email at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages.
