Malicious code in tpkillcpumine (PyPI)
Summary
MAL-2023-7182: Malicious code in tpkillcpumine (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpkillcpumine is a package available on PyPI that is used for CPU mining. It provides functionality to kill processes that consume excessive CPU resources. The package is commonly used in systems where CPU usage needs to be optimized. However, a vulnerability has been discovered in tpkillcpumine that allows the execution of malicious code.
Vulnerability Detail
The vulnerability in tpkillcpumine is a result of the package being included in a set of nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group. These packages contain spyware and information-stealing malware. The specific malicious code in tpkillcpumine can lead to unauthorized access to sensitive information and compromise the security of the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpkillcpumineIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove tpkillcpumine from the system and replace it with a trusted alternative.
Conclusion
The tpkillcpumine package on PyPI has been found to contain malicious code as part of a larger set of malicious packages. This vulnerability can lead to unauthorized access and compromise the security of the system. It is recommended to remove tpkillcpumine and replace it with a trusted alternative. Regularly updating and patching software components is essential to prevent similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tpkillcpumine →
FAQ
tpkillcpumine is a package available on PyPI that is used for CPU mining. It provides functionality to kill processes that consume excessive CPU resources.
The vulnerability in tpkillcpumine is a result of the package being included in a set of nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group. These packages contain spyware and information-stealing malware.
The vulnerability in tpkillcpumine can lead to unauthorized access to sensitive information and compromise the security of the system.
To fix the vulnerability, it is recommended to remove tpkillcpumine from the system and replace it with a trusted alternative. Additionally, regularly updating and patching all software components is crucial to prevent similar vulnerabilities in the future.
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove tpkillcpumine from the system and replace it with a trusted alternative.
