Malicious code in tpreplacecraft (PyPI)
Summary
MAL-2023-7554: Malicious code in tpreplacecraft (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpreplacecraft is a package available on PyPI that is used for replacing text in files. It provides a simple and convenient way to search for and replace text in various file formats. However, this package has been found to contain malicious code.
Vulnerability Detail
The tpreplacecraft package has been compromised by a group known as EsqueleSquad. They have published nearly 6000 malicious PyPi and NPM packages, including tpreplacecraft, which execute spyware and information-stealing malware. The specific vulnerability in tpreplacecraft allows the execution of unauthorized code on the user's system, potentially leading to data theft and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpreplacecraftIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the malicious package and replacing it with a secure alternative.
Conclusion
The tpreplacecraft package on PyPI has been found to contain malicious code, potentially leading to unauthorized access and data theft. It is crucial to remove this package from your project and replace it with a trusted alternative. Regularly updating and auditing the packages used in your project is essential to ensure the security of your software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpreplacecraft →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The malicious code in tpreplacecraft can lead to the execution of spyware and information-stealing malware on the user's system. This can result in unauthorized access to sensitive data, compromise of user credentials, and potential harm to the affected system.
No, there is no fix available for tpreplacecraft itself. The best course of action is to remove the package from your project and replace it with a trusted alternative.
To ensure the security of your Python packages, it is recommended to regularly update and audit the packages used in your project. Use trusted sources such as PyPI and verify the integrity of the packages before including them in your project.
If you suspect your system has been compromised due to the tpreplacecraft vulnerability or any other security issue, it is recommended to disconnect from the network, run a thorough antivirus scan, and seek professional assistance to mitigate the damage and secure your system.
