Malicious code in tpsplitrandcv (PyPI)
Summary
MAL-2023-7594: Malicious code in tpsplitrandcv (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpsplitrandcv package is an open-source Python package available on PyPI. It is used for splitting and randomizing data in machine learning tasks. The package provides functions and utilities to split datasets into training and testing sets, as well as to randomize the order of data samples. This vulnerability affects the tpsplitrandcv package and exposes users to malicious code.
Vulnerability Detail
The tpsplitrandcv package has been found to contain malicious code. The code was introduced in version 0 of the package and is present in all subsequent versions. The malicious code is part of a larger campaign by the EsqueleSquad group, which has published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific impact of this vulnerability may vary depending on the payload delivered by the malicious code, but it poses a significant risk to users' systems and data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpsplitrandcvIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the tpsplitrandcv package and replace it with a trusted alternative.
Conclusion
The tpsplitrandcv package has been found to contain malicious code, posing a significant risk to users' systems and data. It is recommended to remove the package from your project and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is crucial to mitigate the risk of similar vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tpsplitrandcv →
FAQ
tpsplitrandcv is a Python package used for splitting and randomizing data in machine learning tasks. It provides functions and utilities to split datasets into training and testing sets and randomize the order of data samples.
This vulnerability exposes your system to malicious code that can execute spyware and steal sensitive information. It is crucial to remove the tpsplitrandcv package from your project to mitigate the risk.
This vulnerability was discovered by Checkmarx, a security company specializing in software vulnerability detection and prevention.
Yes, all versions of tpsplitrandcv starting from version 0 are affected by this vulnerability.
To protect your software from similar vulnerabilities, it is essential to regularly update and review the packages used in your project. Use trusted sources and consider using a vulnerability monitoring tool like Vulert to receive real-time alerts about open-source vulnerabilities.
