Malicious code in tpminever (PyPI)
Summary
MAL-2023-7287: Malicious code in tpminever (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpminever is a package available on PyPI that is used for [provide brief description of the package's functionality and key attributes]. It is vulnerable to a recently discovered malicious code injection.
Vulnerability Detail
The vulnerability in tpminever is a result of the package being compromised by a group known as EsqueleSquad. They published nearly 6000 malicious PyPi and NPM packages, including tpminever, which execute spyware and information-stealing malware. The specific details of the vulnerability can be found in the Checkmarx report [link to the report]. This vulnerability can have severe consequences, including unauthorized access to sensitive information and potential compromise of the entire system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpmineverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of tpminever to mitigate the risk.
Conclusion
The tpminever package on PyPI has been found to contain malicious code as a result of a larger attack by the EsqueleSquad group. It is crucial for users of tpminever to update to the latest version to mitigate the risk of unauthorized access and data theft. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpminever →
FAQ
You can use Vulert's playground at [link to Vulert playground] to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data theft, and potential compromise of the entire system.
Yes, the maintainers of tpminever have released a patched version that removes the malicious code. It is crucial to update to the latest version to ensure you are not affected by the vulnerability.
There are no known workarounds for this vulnerability. Updating to the latest version of tpminever is the recommended solution.
If you come across any suspicious packages or vulnerabilities, you can report them to the maintainers of the affected package or to security organizations like Checkmarx.
