Malicious Code in tphttpsplit (PyPI)
Summary
MAL-2023-7117: Malicious code in tphttpsplit (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tphttpsplit is a package available on PyPI that provides functionality for splitting HTTP traffic. It is commonly used in Python projects to handle HTTP requests and responses. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in tphttpsplit originates from a malicious package published by the EsqueleSquad group. This package, identified by the SHA256 hash 8fd749877b82f3682380641488c4b66ee8d97964a55af7953c3bdba19986ffa7, was introduced in version 0 of tphttpsplit. When this malicious package is installed, it can execute spyware and steal sensitive information from the affected system. The malicious code can be downloaded from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tphttpsplitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is essential to exercise caution when installing packages from PyPI and verify their authenticity before usage.
Conclusion
The presence of malicious code in tphttpsplit poses a significant risk to the security and privacy of affected systems. It is crucial to take immediate action to remove the malicious package and ensure the installation of secure versions. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tphttpsplit →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
The malicious code in tphttpsplit can execute spyware and steal sensitive information from the affected system. This can lead to unauthorized access, data breaches, and compromise of user privacy.
Yes, the recommended fix is to remove the malicious package from your Python environment and reinstall tphttpsplit from a trusted source. Regularly updating your packages is also crucial to ensure you are using secure versions.
This vulnerability was discovered by Checkmarx, a company specializing in supply chain security. They can be contacted at mailto:supplychainsecurity@checkmarx.com for further information.
To prevent similar vulnerabilities, it is important to exercise caution when installing packages from PyPI or any other package repository. Verify the authenticity of the package and consider using tools like Vulert to monitor and alert for open-source vulnerabilities.
