Malicious code in tppyhttprand (PyPI)
Summary
MAL-2023-7459: Malicious code in tppyhttprand (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tppyhttprand is a package available on PyPI that provides functionality for generating random HTTP requests. It is commonly used in Python applications to simulate HTTP traffic for testing purposes. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in tppyhttprand originates from a malicious PyPi package published by the EsqueleSquad group. This package, when installed, can execute spyware and steal sensitive information from the affected system. The malicious code is present in the package's source code and can be triggered when the package is imported and used in a Python application.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tppyhttprandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the malicious package from your environment to mitigate the risk of spyware and information theft.
Conclusion
The tppyhttprand package available on PyPI has been found to contain malicious code that can execute spyware and steal sensitive information. To protect your Python applications, it is crucial to remove this package from your environment. You can use the Vulert Playground at https://vulert.com/scanner to check if your application is affected by this vulnerability and take appropriate actions for remediation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tppyhttprand →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it to identify any open-source vulnerabilities, including this one.
Yes, if a non-malicious version of tppyhttprand becomes available, you can safely use it in your Python applications. However, it is crucial to ensure that you are using a version that has been verified and does not contain any malicious code.
Yes, there are several alternative packages available on PyPI that provide similar functionality to tppyhttprand. Some popular options include httprunner, requests-mock, and httpretty. It is recommended to choose a package with a good reputation and a large user base to minimize the risk of encountering similar vulnerabilities.
While it is challenging to completely prevent the installation of malicious packages from PyPI, there are some best practices you can follow to minimize the risk. These include carefully reviewing the package's source code, checking the package's reputation and user reviews, and using package management tools that provide security features, such as vulnerability scanning and package verification.
This vulnerability was discovered by Checkmarx, a company specializing in software security. They identified the presence of malicious code in the tppyhttprand package and reported it to the appropriate channels for further investigation and mitigation.
