Malicious Code in visapull (PyPI)
Summary
MAL-2023-7857: Malicious code in visapull (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
visapull is a package available on PyPI that provides functionality related to Visa card transactions. It is commonly used in Python projects to interact with Visa APIs and perform various operations such as retrieving transaction details, processing payments, and managing accounts. Unfortunately, this package has been found to contain malicious code that can execute spyware and steal sensitive information.
Vulnerability Detail
The malicious code in visapull was introduced in version 0 and has been identified by Checkmarx, a security research group. The code is designed to download and execute additional malware from external URLs, such as 'https://dl.dropbox.com/s/tpykidpdjz99202/esquele.exe' and 'https://cdn.discordapp.com/attachments/1090710876639744062/1102575056925761587/bypass2.ps1'. This can lead to unauthorized access to user data, compromise of sensitive information, and potential damage to the affected systems. It is crucial to address this vulnerability promptly to prevent any potential harm.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall visapullIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to a secure version as soon as possible.
Conclusion
The presence of malicious code in the visapull package poses a significant security risk to systems utilizing this package. It is crucial to update to a secure version and take necessary precautions to prevent any potential harm. For further support and guidance on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for visapull →
FAQ
You can check the version of visapull in your project's dependencies or requirements file. If the version is 0 or any version before the fixed release, it is vulnerable.
Manually removing the malicious code from the package is not recommended, as it may require deep understanding of the package's internals and can be error-prone. It is safer and more efficient to update to a secure version.
At the time of this report, there have been no specific incidents or reports of this vulnerability being exploited. However, it is important to address the vulnerability proactively to prevent any potential harm.
Detecting the presence of the malicious code can be challenging, as it may be designed to evade detection. It is recommended to perform a thorough system scan using reputable antivirus software and monitor for any suspicious activities or unauthorized access.
For more information and assistance in fixing this vulnerability, you can reach out to Checkmarx at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages.
