Malicious code in tpvmmc (PyPI)
Summary
MAL-2023-7739: Malicious code in tpvmmc (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tpvmmc package is an open-source Python package available on PyPI. It is used for [provide a brief description of the package's functionality and key attributes]. Unfortunately, this package has been found to contain malicious code, which poses a significant security risk to users who install it.
Vulnerability Detail
The tpvmmc package (version 0 and above) has been identified as containing malicious code. This code was introduced in the package by the Checkmarx source (SHA256: 03989b74d978e7e13b67d397673e2f92e20e110c4b71c00abd4202f9ef1652ba). The malicious code is designed to execute spyware and information-stealing malware on the affected system. Users who install this package are at risk of having their sensitive information compromised and their systems compromised by unauthorized actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tpvmmcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the tpvmmc package from your Python environment to mitigate the risk.
Conclusion
The tpvmmc package has been found to contain malicious code, posing a significant security risk to users who install it. To protect your system and sensitive information, it is recommended to remove the tpvmmc package from your Python environment. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tpvmmc →
FAQ
The tpvmmc package is a Python package available on PyPI. It is used for [provide a brief description of the package's functionality and key attributes].
The malicious code was introduced into the tpvmmc package by the Checkmarx source (SHA256: 03989b74d978e7e13b67d397673e2f92e20e110c4b71c00abd4202f9ef1652ba).
Installing the tpvmmc package puts your system at risk of having sensitive information compromised and being infected with spyware and information-stealing malware.
To fix this vulnerability, you should remove the tpvmmc package from your Python environment by running the command 'pip uninstall tpvmmc'.
There is no known workaround for this vulnerability. It is crucial to remove the tpvmmc package from your Python environment to mitigate the risk.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
