Malicious Code in tpminegrandencode (PyPI)
Summary
MAL-2023-7275: Malicious code in tpminegrandencode (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpminegrandencode is a package available on PyPI that is used for [provide brief description of the package's functionality and key attributes]. This package is vulnerable to a malicious code injection attack.
Vulnerability Detail
The vulnerability (MAL-2023-7275) in tpminegrandencode is a result of the package being included in a list of nearly 6000 malicious PyPi and NPM packages published by the EsqueleSquad group. These packages contain spyware and information-stealing malware. The specific impact of this vulnerability on tpminegrandencode is not mentioned in the provided information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpminegrandencodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section.
Conclusion
The tpminegrandencode package on PyPI has been found to contain malicious code as part of a larger set of malicious packages. It is recommended to remove this package from your project and find a secure alternative. Regularly reviewing and updating the packages used in your project is essential for maintaining security.
See every vulnerability recorded for tpminegrandencode →
FAQ
tpminegrandencode is a package available on PyPI that [provide brief description of the package's functionality and key attributes].
The specific impact of this vulnerability on tpminegrandencode is not mentioned in the provided information.
This vulnerability was discovered by Checkmarx, a security company specializing in supply chain security.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For more information about this vulnerability and its remediation, you can contact Checkmarx at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages.
