Malicious code in tpmchttp (pypi)
Summary
MAL-2023-7259: Malicious code in tpmchttp (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tpmchttp package is an open-source Python package available on PyPI. It is designed to provide functionality related to TPM (Trusted Platform Module) communication over HTTP. TPMs are hardware-based security modules used for secure storage and cryptographic operations. The tpmchttp package allows developers to interact with TPMs over HTTP, enabling integration of TPM functionality into their applications. However, the package has been found to contain malicious code, posing a significant security risk to users.
Vulnerability Detail
The tpmchttp package has been identified as part of a larger malicious campaign conducted by the EsqueleSquad group. This group has published nearly 6000 malicious PyPi and NPM packages, which execute spyware and information-stealing malware. The specific vulnerability in tpmchttp allows attackers to gain unauthorized access to sensitive information and potentially compromise the security of systems utilizing the package. The malicious code can be found in the package's source code, specifically in the version identified by the SHA256 hash '243d69fb6ae2c3ca66c279e81a1a2fe836bef9221bb8e4071943062a9aa216c9'.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpmchttpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. Complete removal of the tpmchttp package is necessary to eliminate the risk of exploitation.
Conclusion
The tpmchttp package on PyPI has been found to contain malicious code as part of a larger campaign by the EsqueleSquad group. This poses a significant security risk to users who have installed or relied on this package. It is crucial to immediately remove the tpmchttp package and any dependencies that rely on it from your project. Additionally, it is recommended to scan your system for signs of compromise and consult with a security professional for further assistance in remediation. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tpmchttp →
FAQ
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the malicious code in tpmchttp.
The malicious code in tpmchttp can lead to unauthorized access to sensitive information, compromise the security of systems, and enable the execution of spyware and information-stealing malware. This can result in data breaches, loss of intellectual property, and damage to the reputation of affected individuals or organizations.
No, there is no patch or updated version available for tpmchttp. The entire package has been identified as malicious, and it is recommended to remove it completely from your project.
While the presence of malicious packages is a concern, it is important to note that the majority of packages on PyPI and NPM are legitimate and safe to use. However, it is crucial to exercise caution and follow best practices for package management, such as regularly updating dependencies, verifying package integrity, and monitoring for security advisories.
If you suspect your system has been compromised due to the presence of the tpmchttp package or any other malicious code, it is recommended to disconnect the affected system from the network, perform a thorough investigation, and engage the assistance of a cybersecurity professional. They can help identify the extent of the compromise, mitigate the impact, and implement measures to prevent future incidents.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
