Malicious code in tpguicvintel (PyPI)
Summary
MAL-2023-7077: Malicious code in tpguicvintel (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpguicvintel is a package available on PyPI that is used for [provide brief description of the package's functionality and key attributes]. It is vulnerable to a malicious code injection that was discovered by Checkmarx. This vulnerability allows attackers to execute spyware and information-stealing malware on systems that have the package installed.
Vulnerability Detail
The vulnerability in tpguicvintel originates from a malicious package published on PyPI by the EsqueleSquad group. The package contains code that can download and execute spyware and information-stealing malware on the affected system. This can lead to unauthorized access to sensitive information and potential compromise of the system. The malicious package has been identified and its details are available on the Checkmarx database.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpguicvintelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability.
Conclusion
The tpguicvintel package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is recommended to remove the package from the system and replace it with a trusted alternative. Regularly updating and patching software components is crucial to mitigate the risk of similar vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpguicvintel →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply provide the Pipfile.lock file of your application and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, updating tpguicvintel to the latest version will not fix this vulnerability as it is present in all versions of the package. It is recommended to remove the package entirely and find a trusted alternative.
The impact of this vulnerability can be severe, as it allows attackers to execute spyware and information-stealing malware on the affected system. This can result in unauthorized access to sensitive information and potential compromise of the system.
Yes, the EsqueleSquad group has published nearly 6000 malicious PyPi and NPM packages. It is important to be cautious and verify the trustworthiness of packages before installing them.
If you come across any other malicious packages or vulnerabilities, you can report them to the Checkmarx team by contacting supplychainsecurity@checkmarx.com or through their website at https://bit.ly/checkmarx-malicious-packages.
