Malicious code in virtualget (PyPI)
Summary
MAL-2023-7821: Malicious code in virtualget (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Virtualget is a package available on PyPI that provides functionality for virtual environments in Python. It allows users to create and manage isolated environments for their Python projects. However, the package has been found to contain malicious code, which poses a significant security risk to users who install it.
Vulnerability Detail
The virtualget package from PyPI has been compromised by a group known as EsqueleSquad. They have published nearly 6000 malicious packages on PyPI and NPM, including virtualget, that execute spyware and information-stealing malware. This malicious code can potentially compromise the security and privacy of users' systems and steal sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall virtualgetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually delete the virtualget package from your Python environment by removing its installation directory. However, this is not a recommended solution as it may leave remnants of the malicious code behind. It is strongly advised to completely remove the package using the recommended fix mentioned above.
Conclusion
The virtualget package from PyPI has been found to contain malicious code, posing a significant security risk to users. It is recommended to remove the package from your Python environment using the provided fix. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for virtualget →
FAQ
You can check if you have the virtualget package installed by running the following command:
pip show virtualget
Having the virtualget package installed puts your system at risk of being compromised by spyware and information-stealing malware. This can lead to unauthorized access to your sensitive information and potential privacy breaches.
Unfortunately, due to the nature of the compromise, it is not possible to verify the integrity of the virtualget package. It is recommended to remove the package from your Python environment to ensure your system's security.
Yes, you can still create and manage virtual environments in Python without the virtualget package. There are alternative packages available, such as virtualenv, that provide similar functionality.
To protect your Python environment from similar vulnerabilities, it is important to regularly update your packages to the latest versions. Additionally, you can use tools like Vulert to monitor and alert you about open-source vulnerabilities in your software.
