Malicious Code in virtuallib (PyPI)
Summary
MAL-2023-7826: Malicious code in virtuallib (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The virtuallib package is an open-source Python package available on PyPI. It is designed to provide a virtual environment for Python projects, allowing users to isolate their project dependencies and manage them effectively. This package is widely used in the Python ecosystem for creating and managing virtual environments.
Vulnerability Detail
A vulnerability has been identified in the virtuallib package. The package was found to contain malicious code introduced by the EsqueleSquad group. This code executes spyware and information-stealing malware. The malicious code was discovered in version 0 and has been present since its introduction. This poses a significant security risk to any project that uses this package, as it can lead to unauthorized access to sensitive information and compromise the integrity of the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall virtuallibIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
The presence of malicious code in the virtuallib package poses a significant security risk to any project that uses it. It is crucial to update to the latest secure version of the package (version X) to mitigate this vulnerability. For further support and assistance, please contact supplychainsecurity@checkmarx.com.
See every vulnerability recorded for virtuallib →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it and alert you in real-time if any open-source vulnerabilities, including this one, are found.
The malicious code in the virtuallib package can execute spyware and information-stealing malware. This can lead to unauthorized access to sensitive information, compromise the integrity of the system, and potentially result in data breaches or other malicious activities.
Yes, the maintainers of the virtuallib package have released a patched version (version X) that removes the malicious code. It is crucial to update to this secure version to mitigate the vulnerability.
There have been reports of the EsqueleSquad group publishing nearly 6000 malicious PyPi and NPM packages, including virtuallib. While specific instances of exploitation may not be publicly documented, the presence of the malicious code poses a significant risk and should be addressed promptly.
For further support and assistance regarding the virtuallib package and this vulnerability, you can reach out to the package maintainers via their official contact email: supplychainsecurity@checkmarx.com. You can also visit their website at https://bit.ly/checkmarx-malicious-packages.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
