Malicious code in tppullkill (PyPI)
Summary
MAL-2023-7425: Malicious code in tppullkill (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tppullkill package is an open-source Python package available on PyPI. It is designed to provide functionality for pulling and killing processes in a multi-threaded manner. The package is commonly used in various Python applications to manage and control processes efficiently. However, the tppullkill package has been found to contain malicious code, making it vulnerable to security risks.
Vulnerability Detail
The tppullkill package has been identified as containing malicious code by the EsqueleSquad group. This group has published nearly 6000 malicious PyPi and NPM packages, including tppullkill, which execute spyware and information-stealing malware. The specific vulnerability in tppullkill allows attackers to gain unauthorized access to sensitive information, compromise system integrity, and potentially cause significant damage. The malicious code can be triggered when the package is installed or executed within a Python application.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tppullkillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the tppullkill package and take necessary precautions to prevent the installation or execution of any malicious packages.
Conclusion
The tppullkill package has been found to contain malicious code, posing a significant security risk to Python applications that use it. It is crucial to remove the package from your environment and take necessary precautions to prevent the installation or execution of any malicious packages. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tppullkill →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities without requiring access to the code or installation.
The malicious code in tppullkill can lead to unauthorized access to sensitive information, compromise the integrity of your system, and enable attackers to execute spyware and information-stealing malware. This can result in data breaches, loss of confidential information, and potential damage to your organization's reputation.
To remove the tppullkill package, you can use the following command:
pip uninstall tppullkill
Yes, there are alternative packages available that provide similar functionality to tppullkill. It is recommended to research and choose a package from a trusted source with a good track record of security and reliability.
To prevent the installation of malicious packages, it is important to verify the source and integrity of the packages you install. Stick to trusted package repositories like PyPI and NPM, and regularly update and monitor the packages in your environment. Additionally, consider using security tools like Vulert to detect and alert you about potential vulnerabilities in your dependencies.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
