Malicious code in tpsplitpystudy (PyPI)
Summary
MAL-2023-7592: Malicious code in tpsplitpystudy (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpsplitpystudy package is an open-source Python package available on PyPI. It is designed to perform specific data splitting operations for Python studies. The package is commonly used in data analysis and research projects. However, it has been discovered that a malicious code injection has occurred in the package, potentially compromising the security and integrity of systems that utilize it.
Vulnerability Detail
The malicious code injection in tpsplitpystudy was identified by the Checkmarx security research team. The injected code is part of a larger campaign by the EsqueleSquad group, which has published nearly 6000 malicious PyPi and NPM packages. The injected code executes spyware and information-stealing malware, posing a significant threat to systems that have installed the compromised tpsplitpystudy package. The malicious code can lead to unauthorized access, data exfiltration, and potential compromise of sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpsplitpystudyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. The best course of action is to remove the tpsplitpystudy package and follow the recommended steps for remediation.
Conclusion
The presence of malicious code in the tpsplitpystudy package poses a significant security risk to systems that have installed it. It is crucial to take immediate action by removing the package, conducting a thorough security audit, and updating all other packages and dependencies. Regular monitoring of open-source vulnerabilities, such as using Vulert, can help prevent similar incidents in the future. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for tpsplitpystudy →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
The malicious code in tpsplitpystudy can lead to unauthorized access, data exfiltration, and compromise of sensitive information. It is crucial to take immediate action to mitigate the risk.
While specific exploits targeting this vulnerability have not been disclosed, the presence of malicious code in the package increases the risk of exploitation. It is essential to remove the compromised package to prevent any potential attacks.
Yes, you can continue using other packages and dependencies in your system. However, it is crucial to ensure that all packages are up to date and free from any known vulnerabilities. Regularly monitoring and updating your dependencies is a good security practice.
If you have further questions or need assistance with vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and support in addressing this issue.
