Malicious code in tpsupermcmc (pypi)
Summary
MAL-2023-7647: Malicious code in tpsupermcmc (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpsupermcmc package is an open-source Python package available on PyPI. It is designed to provide functionality for performing Markov Chain Monte Carlo (MCMC) simulations using the tpsuper algorithm. The package is commonly used in scientific research and data analysis. However, it has been discovered that a malicious version of the package has been published on PyPI, containing spyware and information-stealing malware.
Vulnerability Detail
The tpsupermcmc package has been compromised by the EsqueleSquad group, who published a malicious version of the package on PyPI. This malicious version contains hidden code that executes spyware and information-stealing malware when installed and used. The malware can potentially compromise sensitive data and compromise the security of systems using the package. The malicious code can be found in the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpsupermcmcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The tpsupermcmc package on PyPI has been compromised by the EsqueleSquad group, who published a malicious version containing spyware and information-stealing malware. It is important to remove the malicious version from your system, scan for any signs of compromise, and take appropriate action to secure your data and systems. Regularly updating packages from trusted sources and following best practices for package management can help prevent similar incidents in the future. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpsupermcmc →
FAQ
You can check the version of tpsupermcmc installed on your system by running 'pip show tpsupermcmc' in your terminal. If the version matches the malicious version mentioned in the vulnerability details, you may have the compromised package installed.
If you have the malicious version of tpsupermcmc installed, it is recommended to immediately remove it from your system. You should also scan your system for any signs of compromise and take appropriate action to secure your data and systems.
While PyPI is generally a trusted source for Python packages, this incident highlights the importance of verifying the integrity of packages before installation. It is recommended to review the package details, user reviews, and community feedback before installing any package from PyPI.
To protect your system from similar incidents, it is important to follow best practices for package management. This includes regularly updating your packages from trusted sources, verifying the integrity of packages before installation, and scanning your system for any signs of compromise.
Detecting if your system has been compromised by the malicious version of tpsupermcmc can be challenging. It is recommended to scan your system using reputable antivirus software and monitor for any suspicious activities or unauthorized access.
