Malicious code in tppeprand (PyPI)
Summary
MAL-2023-7340: Malicious code in tppeprand (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tppeprand is a package available on PyPI that is used for generating random numbers. It is commonly used in Python projects for various purposes such as cryptography, simulation, and testing. However, this package has been found to contain malicious code.
Vulnerability Detail
The tppeprand package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in tppeprand allows the execution of unauthorized code on the user's system, potentially leading to data theft, system compromise, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tppeprandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the tppeprand package and following the recommended steps to fix the issue.
Conclusion
The tppeprand package on PyPI has been found to contain malicious code, potentially leading to unauthorized code execution and data theft. It is crucial to remove this package from your project and replace it with a trusted alternative. Regularly updating dependencies and using security tools like Vulert can help mitigate the risk of similar vulnerabilities in the future. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tppeprand →
FAQ
You can check your project's dependencies file (e.g., requirements.txt or Pipfile.lock) to see if tppeprand is listed. Additionally, you can use tools like Vulert (https://vulert.com) to scan your project for vulnerabilities.
The malicious code in tppeprand can lead to unauthorized code execution, data theft, and system compromise. It is crucial to take immediate action to mitigate these risks.
There have been reports of the EsqueleSquad group publishing malicious packages, including tppeprand. While specific instances of exploitation may not be publicly documented, it is essential to treat this vulnerability seriously and take appropriate measures to protect your systems.
While the tppeprand package has been compromised, it does not imply that all packages on PyPI are untrustworthy. However, it is crucial to exercise caution and verify the reputation and security of the packages you use. Regularly updating your dependencies and using tools like Vulert can help identify potential vulnerabilities.
If you come across any suspicious packages or vulnerabilities, it is recommended to report them to the package maintainers or the relevant security teams. You can also use platforms like Vulert to report and track vulnerabilities in open-source software.
