Malicious code in tppyinfo (PyPI)
Summary
MAL-2023-7461: Malicious code in tppyinfo (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tppyinfo is a package available on PyPI that provides functionality related to TP-Link smart plugs. It allows users to gather information about the plugs, such as their IP address, firmware version, and power consumption. This package is vulnerable to a malicious code injection.
Vulnerability Detail
The tppyinfo package has been found to contain malicious code introduced by the Checkmarx group. This code is designed to execute spyware and information-stealing malware on the user's system. The malicious code can be triggered when the package is installed or updated, potentially compromising the user's sensitive information and system security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tppyinfoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the tppyinfo package and following the recommended steps to mitigate the risk.
Conclusion
The tppyinfo package on PyPI has been found to contain malicious code that can execute spyware and information-stealing malware. It is crucial to remove this package from your system and follow the recommended steps to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tppyinfo →
FAQ
tppyinfo is a PyPI package that allows users to gather information about TP-Link smart plugs.
The malicious code in tppyinfo can execute spyware and information-stealing malware on the user's system, potentially compromising their sensitive information and system security.
To fix this vulnerability, remove the tppyinfo package from your system and avoid using it. Regularly update your packages from trusted sources and verify their integrity using tools like Vulert.
Yes, consider using alternative packages that provide similar functionality but are not affected by this vulnerability.
You can use tools like Vulert to verify the integrity of your packages and receive real-time alerts for open-source vulnerabilities.
