Malicious code in verad (PyPI)
Summary
MAL-2023-7805: Malicious code in verad (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The verad package is an open-source Python package available on PyPI. It is used for [provide a brief description of the package's functionality and key attributes]. Unfortunately, this package has been found to contain malicious code, as identified by the Checkmarx security group. The malicious code was introduced in version 0 of the package.
Vulnerability Detail
The verad package has been compromised with malicious code, which was introduced in version 0. This vulnerability allows attackers to execute spyware and information-stealing malware on systems where the package is installed. The malicious code can be found in the package's PyPI distribution. The Checkmarx security group has identified this issue and published a report on it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall veradIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to take immediate action by removing the verad package and replacing it with a secure alternative.
Conclusion
The verad package on PyPI has been found to contain malicious code, allowing attackers to execute spyware and information-stealing malware. It is crucial to take immediate action by removing the package and replacing it with a trusted alternative. Regularly updating and monitoring the packages used in your projects is essential to ensure the security of your software.
See every vulnerability recorded for verad →
FAQ
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The malicious code in the verad package can execute spyware and information-stealing malware on affected systems. This can lead to unauthorized access to sensitive information, data breaches, and potential harm to users.
Yes, the recommended fix is to remove the verad package from your system and replace it with a trusted alternative. Regularly updating and monitoring the packages used in your projects is also crucial to mitigate potential security risks.
This vulnerability was discovered by the Checkmarx security group. They identified the presence of malicious code in the verad package and published a report on it.
If you have discovered other vulnerabilities or need further assistance with vulnerability remediation, you can contact info@devnack.com for support.
