Malicious code in tpreramcpu (PyPI)
Summary
MAL-2023-7572: Malicious code in tpreramcpu (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpreramcpu package is an open-source Python package available on PyPI. It is used for [provide details about the functionality and key attributes of the package]. Unfortunately, this package has been found to contain malicious code.
Vulnerability Detail
The tpreramcpu package has been identified as one of the nearly 6000 malicious PyPi packages published by the EsqueleSquad group. These packages execute spyware and information-stealing malware. The specific details of the vulnerability can be found in the Checkmarx report with SHA256 hash 414b9ac07cd030d8075a85643ab7912ab4678c436841a40a1b28ff1db2822fa1. This vulnerability poses a significant risk to users who install and use the tpreramcpu package, as it can lead to unauthorized access to sensitive information and compromise the security of their systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpreramcpuIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the tpreramcpu package to ensure the security of your system.
Conclusion
The tpreramcpu package has been found to contain malicious code, posing a significant risk to users. It is crucial to remove this package from your Python environment to ensure the security of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpreramcpu →
FAQ
The tpreramcpu package is a Python package available on PyPI. It is used for [provide details about the functionality and key attributes of the package].
The malicious code in the tpreramcpu package was discovered by the EsqueleSquad group, who published a report detailing the presence of spyware and information-stealing malware in nearly 6000 PyPi packages.
This vulnerability can lead to unauthorized access to sensitive information and compromise the security of systems where the tpreramcpu package is installed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will alert you in real-time for any open-source vulnerabilities, including this one.
You can find more information about this vulnerability in the Checkmarx report with SHA256 hash 414b9ac07cd030d8075a85643ab7912ab4678c436841a40a1b28ff1db2822fa1.
