Malicious code in tpnvidiaver (PyPI)
Summary
MAL-2023-7302: Malicious code in tpnvidiaver (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpnvidiaver is a package available on PyPI that is used for NVIDIA graphics card version detection. It provides functionality to determine the version of the installed NVIDIA graphics card. This package is vulnerable to a malicious code injection.
Vulnerability Detail
The tpnvidiaver package has been found to contain malicious code introduced by the Checkmarx security group. This code can execute spyware and information-stealing malware on the affected system. The malicious code is present in the package version 0 and onwards. The package can be downloaded from the PyPI repository.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpnvidiaverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, removing the tpnvidiaver package and ensuring the use of trusted packages can mitigate the risk of exploitation.
Conclusion
The tpnvidiaver package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is recommended to remove this package from your project and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is essential to maintain a secure software ecosystem. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpnvidiaver →
FAQ
tpnvidiaver is a package used for NVIDIA graphics card version detection in Python projects.
The malicious code in tpnvidiaver can execute spyware and information-stealing malware on the affected system, potentially compromising sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Removing the tpnvidiaver package and replacing it with a trusted alternative is the recommended solution. However, it may require some modifications to your code depending on how the package is used.
Regularly updating and reviewing the packages used in your project is crucial to ensure they are free from vulnerabilities. Tools like Vulert can help in monitoring and alerting for open-source vulnerabilities.
