Malicious code in tpgetvirtualpull (PyPI)
Summary
MAL-2023-7058: Malicious code in tpgetvirtualpull (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpgetvirtualpull is a package available on PyPI that provides functionality for virtual pull requests. It is commonly used in Python projects to manage virtual environments and streamline the development process. However, this package has been found to contain malicious code, which poses a significant security risk to users who install and use it.
Vulnerability Detail
The tpgetvirtualpull package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware, putting users' sensitive data and systems at risk. The specific vulnerability in tpgetvirtualpull allows the execution of arbitrary code, enabling attackers to gain unauthorized access, exfiltrate data, or perform other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpgetvirtualpullIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the tpgetvirtualpull package and follow the recommended steps to mitigate the risk.
Conclusion
The tpgetvirtualpull package on PyPI has been compromised by the EsqueleSquad group, leading to the distribution of malicious code. This vulnerability allows attackers to execute arbitrary code and potentially gain unauthorized access to systems, exfiltrate data, or perform other malicious activities. To protect your systems, it is crucial to remove the tpgetvirtualpull package, scan for signs of compromise, and follow recommended security practices. For further support and assistance in vulnerability remediation, you can contact the Vulert team at DevNack.com.
See every vulnerability recorded for tpgetvirtualpull →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
The malicious code in tpgetvirtualpull can lead to unauthorized access to your system, data exfiltration, and the installation of additional malware. Attackers may be able to steal sensitive information, compromise your system's integrity, or use it as a launching pad for further attacks.
At this time, there is no specific evidence of exploitation related to this vulnerability. However, given the widespread distribution of the malicious packages and the potential impact, it is crucial to take immediate action to protect your systems.
While the presence of malicious packages is a concern, it is important to note that the majority of packages available on PyPI and NPM are safe to use. However, it is always recommended to exercise caution, review package details, and regularly update your dependencies to mitigate potential risks.
If you come across any suspicious packages or believe you have identified a vulnerability, you can report it to the package maintainers or the respective platform's security team. Additionally, you can reach out to the Vulert team at info@devnack.com for further support and guidance.
