Malicious code in tpreplaceget (PyPI)
Summary
MAL-2023-7556: Malicious code in tpreplaceget (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpreplaceget is a package available on PyPI that is used for replacing text in files. It provides a simple and convenient way to search for and replace text in various file formats. The package is widely used in Python projects for automating text replacement tasks. However, a recent vulnerability has been discovered in tpreplaceget that allows the execution of malicious code.
Vulnerability Detail
The vulnerability in tpreplaceget is a result of a malicious package published on PyPI by the EsqueleSquad group. This package contains spyware and information-stealing malware. When tpreplaceget is installed, it may inadvertently install this malicious package, leading to the execution of the spyware and theft of sensitive information. The malicious package can be identified by its SHA256 hash: 1118433ffd79bdc0b207b9aa9689b96b2d15fdbb4e4f8ab4d69b4da5407afc6b.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpreplacegetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually remove the tpreplaceget package from your project by running the following command:
pip uninstall tpreplaceget
Conclusion
The tpreplaceget package on PyPI has been found to contain a malicious package that executes spyware and information-stealing malware. It is crucial to remove the tpreplaceget package from your project and take appropriate measures to mitigate the impact of the spyware. Regularly updating your security software and practicing secure coding practices can help prevent similar vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tpreplaceget →
FAQ
The malicious package is installed when tpreplaceget is installed as a dependency in a Python project. It may be included as a transitive dependency or directly specified in the project's requirements file.
The spyware and information-stealing malware included in the malicious package can lead to unauthorized access to sensitive information, data breaches, and potential compromise of systems and networks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While removing the tpreplaceget package is crucial, it is also important to scan your system for any signs of compromise and take appropriate measures to mitigate the impact. This may include running antivirus scans, monitoring network traffic, and reviewing system logs for any suspicious activity.
To prevent similar vulnerabilities, it is recommended to regularly update your project's dependencies and use tools like Vulert to monitor for any known vulnerabilities in your software stack. Additionally, practicing secure coding practices and following best practices for software development can help minimize the risk of introducing vulnerabilities.
