Malicious code in tpstrsplit (PyPI)
Summary
MAL-2023-7630: Malicious code in tpstrsplit (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpstrsplit is a package available on PyPI that provides functionality for splitting strings based on a specified delimiter. It is commonly used in Python projects for string manipulation tasks. However, this package has been found to contain malicious code.
Vulnerability Detail
The tpstrsplit package has been compromised by the EsqueleSquad group, who published nearly 6000 malicious PyPi and NPM packages. These packages execute spyware and information-stealing malware. The specific vulnerability in tpstrsplit allows the execution of arbitrary code, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpstrsplitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. Complete removal of the tpstrsplit package is the best course of action.
Conclusion
The tpstrsplit package on PyPI has been compromised by the EsqueleSquad group, leading to the execution of malicious code. To protect your project and data, it is crucial to remove this package and replace it with a trusted alternative. Regularly reviewing and updating your project's dependencies is essential to mitigate the risk of using compromised packages. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tpstrsplit →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock file, and Vulert will analyze it for open-source vulnerabilities.
There have been reports of the EsqueleSquad group actively exploiting this vulnerability in the wild. It is crucial to take immediate action to mitigate the risk.
No, there is no official patch available for tpstrsplit. The package itself has been compromised, and it is recommended to remove it entirely from your project.
While PyPI is generally a reliable source for packages, it is essential to exercise caution and review the reputation and security of each package before including it in your project. Regularly updating and monitoring your dependencies is crucial to mitigate the risk of using compromised packages.
If you come across a malicious package on PyPI, it is recommended to report it to the PyPI administrators and provide any relevant information about the package. Additionally, consider notifying the package maintainer and the broader community to raise awareness of the issue.
