Malicious Code in ultragame (PyPI)
Summary
MAL-2023-7751: Malicious code in ultragame (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ultragame is a package available on PyPI that provides functionality for gaming. It is vulnerable to a malicious code injection that was discovered by Checkmarx. This vulnerability allows for the execution of spyware and information-stealing malware.
Vulnerability Detail
The malicious code injection in ultragame was introduced in version 0 and is present in all subsequent versions. The code was published by the EsqueleSquad group, who released nearly 6000 malicious PyPi and NPM packages. The injected code can execute spyware and steal sensitive information from the affected system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ultragameIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to update ultragame to a secure version.
Conclusion
The malicious code injection in ultragame poses a significant security risk as it can execute spyware and steal sensitive information. It is crucial to update ultragame to a secure version and regularly update all dependencies to ensure the overall security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ultragame →
FAQ
ultragame is a package available on PyPI that provides functionality for gaming.
This vulnerability was discovered by Checkmarx during their security analysis of PyPI packages.
The malicious code injection in ultragame can execute spyware and steal sensitive information from the affected system.
Yes, all versions of ultragame starting from version 0 are affected by this vulnerability.
To protect your application, it is recommended to update ultragame to a version that is not affected by the malicious code injection. Regularly updating all dependencies is also important for overall security.
