Malicious code in tpgetlibget (PyPI)
Summary
MAL-2023-7048: Malicious code in tpgetlibget (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpgetlibget is a package available on PyPI that provides functionality for retrieving libraries from a remote server. It is commonly used in Python projects to manage dependencies. However, this package has been found to contain malicious code that can execute spyware and information-stealing malware.
Vulnerability Detail
The vulnerability originates from a malicious package published by the EsqueleSquad group. This package, which has the same name as tpgetlibget, is designed to look like a legitimate version but contains harmful code. When developers unknowingly install this malicious package, it can compromise the security of their systems and steal sensitive information. The package includes URLs to download additional malware files, such as 'esquele.exe' and 'bypass2.ps1'.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpgetlibgetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to carefully review the packages you install, especially those from untrusted sources. Verifying the package's integrity and checking for any signs of suspicious behavior can help mitigate the risk of installing malicious code.
Conclusion
The presence of malicious code in tpgetlibget poses a significant security risk to Python projects. It is crucial to promptly remove the malicious package, scan for malware, and update dependencies to ensure the integrity and security of your software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpgetlibget →
FAQ
You can use tools like Vulert (https://vulert.com) to scan your project and identify any vulnerable packages. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Installing the malicious package can lead to the execution of spyware and information-stealing malware on your system. This can result in unauthorized access to sensitive data, compromise of user credentials, and potential damage to your infrastructure.
If your system is already compromised, it is essential to take immediate action. Disconnect the affected system from the network, perform a thorough malware scan, and follow incident response procedures to mitigate the impact. It is also recommended to seek assistance from cybersecurity professionals.
To prevent similar vulnerabilities, it is crucial to follow secure coding practices and regularly update your dependencies. Only install packages from trusted sources and verify their integrity before use. Additionally, consider using automated vulnerability scanning tools to detect and mitigate potential risks.
If you have identified this vulnerability or need further assistance, you can contact the Checkmarx team at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages.
