Malicious code in tpurlintel (pypi)
Summary
MAL-2023-7684: Malicious code in tpurlintel (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpurlintel is a package available on PyPI that provides functionality related to URL intelligence. It is used to analyze and extract information from URLs. The package is vulnerable to a malicious code injection.
Vulnerability Detail
The tpurlintel package has been found to contain malicious code introduced by the EsqueleSquad group. This code executes spyware and information-stealing malware. The malicious code can be downloaded from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1. The impact of this vulnerability can lead to unauthorized access to sensitive information and compromise the security of systems using tpurlintel.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpurlintelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the tpurlintel package and replacing it with a secure alternative.
Conclusion
The tpurlintel package on PyPI has been found to contain malicious code introduced by the EsqueleSquad group. This code executes spyware and information-stealing malware, posing a significant security risk. It is recommended to remove the tpurlintel package from your project and replace it with a trusted alternative. Regularly updating and reviewing the packages used in your project is essential to ensure they are free from known vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tpurlintel →
FAQ
tpurlintel is a package available on PyPI that provides functionality related to URL intelligence. It is used to analyze and extract information from URLs.
The malicious code introduced by the EsqueleSquad group in tpurlintel executes spyware and information-stealing malware, compromising the security of systems using this package.
This vulnerability can lead to unauthorized access to sensitive information and compromise the security of systems using tpurlintel.
To fix this vulnerability, remove the tpurlintel package from your project and replace it with a trusted alternative. Regularly update and review the packages used in your project to ensure they are free from known vulnerabilities.
There is no known workaround for this vulnerability. It is crucial to remove the tpurlintel package and replace it with a secure alternative.
