Malicious code in tpsplitpushpush (PyPI)
Summary
MAL-2023-7591: Malicious code in tpsplitpushpush (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpsplitpushpush package is an open-source Python package available on PyPI. It is used for splitting and pushing data. The package allows users to split data into smaller chunks and push them to different destinations. It is commonly used in data processing and ETL (Extract, Transform, Load) pipelines. However, the package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The tpsplitpushpush package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. The malicious code in tpsplitpushpush can execute spyware and steal sensitive information from the affected system. This poses a significant security risk to any application or system that uses this package. The malicious code can be triggered when the package is installed or executed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpsplitpushpushIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to remove the tpsplitpushpush package and follow the recommended steps to fix the vulnerability.
Conclusion
The tpsplitpushpush package has been found to contain malicious code, posing a significant security risk to systems and applications that use it. It is crucial to remove the package, scan for compromise, and take appropriate measures to mitigate the impact. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tpsplitpushpush →
FAQ
tpsplitpushpush is an open-source Python package used for splitting and pushing data in data processing and ETL pipelines.
The malicious code in tpsplitpushpush can execute spyware and steal sensitive information from the affected system. It is triggered when the package is installed or executed.
The malicious code in tpsplitpushpush was introduced by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages.
The potential ramifications of this vulnerability include unauthorized access to sensitive information, data theft, and the execution of spyware on the affected system.
To protect your system, it is recommended to remove the tpsplitpushpush package, scan your system for signs of compromise, update your security software, and follow best practices for secure software development and deployment.
