Malicious Code in tppeppaypalhttp (PyPI)
Summary
MAL-2023-7335: Malicious code in tppeppaypalhttp (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tppeppaypalhttp is a package available on PyPI that provides functionality for integrating with the PayPal HTTP API. It allows developers to make HTTP requests to the PayPal API and handle responses. This package is vulnerable to a malicious code injection.
Vulnerability Detail
The tppeppaypalhttp package has been found to contain malicious code. The code was introduced in version 0 and is present in the package's source code. The malicious code can execute spyware and information-stealing malware. This vulnerability poses a significant risk to applications that use this package, as it can lead to unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tppeppaypalhttpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to a secure version as soon as possible.
Conclusion
The tppeppaypalhttp package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is crucial for developers using this package to update to a secure version and take necessary steps to protect their applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tppeppaypalhttp →
FAQ
tppeppaypalhttp is a PyPI package that provides functionality for integrating with the PayPal HTTP API. It allows developers to make HTTP requests to the PayPal API and handle responses.
The malicious code in tppeppaypalhttp can execute spyware and information-stealing malware. This can lead to unauthorized access to sensitive information in applications that use this package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, it is recommended to update the tppeppaypalhttp package to a version that does not contain the malicious code. Check the official PyPI repository for an updated and secure version of the package.
If your application is affected by this vulnerability, it is crucial to update the tppeppaypalhttp package to a secure version as soon as possible. Additionally, scan your application for any signs of compromise and take appropriate actions to mitigate any potential damage caused by the malicious code.
