Malicious code in tphttprand (PyPI)
Summary
MAL-2023-7116: Malicious code in tphttprand (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tphttprand is a package available on PyPI that provides functionality for generating random HTTP headers. It is commonly used in Python applications to simulate HTTP requests. However, this package has been found to contain malicious code that can execute spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in tphttprand originates from a malicious package published by the EsqueleSquad group. This package, identified by the SHA256 hash 0e203608c9d1aa57f05cc1569c8a4b6be07fbc3d433967e203f1db43c864796a, was introduced in version 0 of tphttprand. When this malicious package is installed, it can compromise the security of the system by executing spyware and stealing sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tphttprandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to regularly review and audit the packages used in your application, and to rely on reputable sources for package installation.
Conclusion
The presence of malicious code in tphttprand poses a significant security risk to systems that have installed the affected package. It is crucial to remove the malicious package and take necessary precautions to ensure the security of your application. For further support and guidance on vulnerability remediation, you can reach out to the Checkmarx supply chain security team at supplychainsecurity@checkmarx.com.
See every vulnerability recorded for tphttprand →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, you can continue using tphttprand after removing the malicious package. However, it is crucial to ensure that you install a clean and trusted version of tphttprand from a reputable source.
Yes, there are alternative packages available on PyPI that provide similar functionality to tphttprand. It is recommended to search for and evaluate these alternatives to find a package that is not affected by this vulnerability.
The malicious code in tphttprand can execute spyware and steal sensitive information from the system. This can lead to unauthorized access, data breaches, and compromise of user privacy. It is crucial to address this vulnerability promptly to mitigate these risks.
If you have identified this vulnerability or need further support, you can contact the Checkmarx supply chain security team at supplychainsecurity@checkmarx.com. They will be able to assist you with vulnerability remediation and provide additional guidance.
