Malicious code in tpencodepingre (PyPI)
Summary
MAL-2023-7018: Malicious code in tpencodepingre (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpencodepingre is a package available on PyPI that provides encoding and decoding functionality. It is commonly used in Python projects for various purposes. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability originates from a malicious package published by the EsqueleSquad group. This package, identified by the SHA256 hash 13ec00abf526410b5b50c97d6f18dab942b3d66dae93a646f8e428f16eec9a4c, was introduced in version 0 of tpencodepingre. The malicious code can be downloaded from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1. This code can compromise the security and privacy of the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpencodepingreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the malicious package and replacing it with a secure alternative.
Conclusion
The tpencodepingre package on PyPI has been found to contain malicious code, potentially leading to the execution of spyware and information-stealing malware. It is crucial to remove this package from your Python projects and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your projects is essential to mitigate potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tpencodepingre →
FAQ
tpencodepingre is a Python package available on PyPI that provides encoding and decoding functionality.
The vulnerability was discovered by the Checkmarx team, who identified a malicious package published by the EsqueleSquad group.
The malicious code in tpencodepingre can execute spyware and information-stealing malware, compromising the security and privacy of affected systems.
To protect your Python project, it is recommended to remove the tpencodepingre package and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is also crucial.
No, there are no known workarounds for this vulnerability. Immediate action should be taken to remove the malicious package and replace it with a secure alternative.
