Malicious code in tpmasklibsplit (PyPI)
Summary
MAL-2023-7242: Malicious code in tpmasklibsplit (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpmasklibsplit is a package available on PyPI that provides functionality related to TPM (Trusted Platform Module) masking. It is used to split TPM keys into multiple parts for secure storage and retrieval. The package is commonly used in applications that require TPM functionality for secure key management.
Vulnerability Detail
A malicious code injection vulnerability has been discovered in tpmasklibsplit. The vulnerability originates from a malicious package published on PyPI by the EsqueleSquad group. The package contains spyware and information-stealing malware. When the malicious package is installed, it can compromise the security of the system and potentially lead to unauthorized access, data theft, and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpmasklibsplitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can take preventive measures by carefully reviewing the packages they install, verifying the source and integrity of the packages, and using security tools like Vulert to monitor and alert for open-source vulnerabilities.
Conclusion
The tpmasklibsplit package on PyPI has been found to contain a malicious code injection vulnerability. This vulnerability can compromise the security of the system and lead to unauthorized access and data theft. It is important to remove the malicious package, verify the integrity of packages, and regularly update and patch the software to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpmasklibsplit →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this specific tpmasklibsplit vulnerability.
The potential risks of this vulnerability include unauthorized access to sensitive data, information theft, compromise of system security, and potential exploitation of other vulnerabilities in the system.
Yes, the fix for this vulnerability involves removing the malicious package from the system and ensuring that only trusted packages are installed from reputable sources. Regularly updating and patching the software and its dependencies can also help mitigate the risk.
To prevent such vulnerabilities in the future, it is important to review and verify the packages before installation, use reputable sources for package installation, and regularly update and patch the software and its dependencies. Additionally, using security tools like Vulert can help monitor and alert for open-source vulnerabilities.
Yes, this vulnerability can be exploited remotely if the malicious package is installed on a system accessible over the network. It is important to remove the package and take necessary preventive measures to mitigate the risk.
