Malicious code in tpvirtualrandom (PyPI)
Summary
MAL-2023-7715: Malicious code in tpvirtualrandom (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tpvirtualrandom is a package available on PyPI that provides functionality for generating random numbers. It is commonly used in Python projects for various purposes. However, this package has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware.
Vulnerability Detail
The vulnerability in tpvirtualrandom originates from a malicious package published by the EsqueleSquad group. This package, identified by the SHA256 hash b1a1e599c001e884bb9832cdaf70918cc45f288f2ac506a947ba452db651e127, was introduced in version 0 of tpvirtualrandom. When this version is installed, it can download and execute additional malicious files from the following URLs: https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe and https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1. The presence of this malicious code puts users at risk of unauthorized data access and potential compromise of their systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpvirtualrandomIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually remove the malicious files downloaded by the vulnerable version of tpvirtualrandom. This can be done by deleting the files esquele.exe and bypass2.ps1 from your system. Additionally, it is recommended to run a thorough malware scan on your system to ensure no other malicious files are present.
Conclusion
In conclusion, the tpvirtualrandom package on PyPI has been found to contain malicious code, which can lead to the execution of spyware and information-stealing malware. It is crucial to uninstall the vulnerable version and update to a secure version to protect your systems and data. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpvirtualrandom →
FAQ
tpvirtualrandom is a Python package that provides functionality for generating random numbers. It is commonly used in various Python projects.
The vulnerability was discovered by the Checkmarx team, who identified a malicious package published by the EsqueleSquad group on PyPI.
The presence of the malicious code in tpvirtualrandom can lead to the execution of spyware and information-stealing malware, putting users' data and systems at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
Yes, the recommended fix is to uninstall the vulnerable version of tpvirtualrandom (version 0) and update to a secure version, if available.
