Malicious Code in PyPI Package vminfo
Summary
MAL-2023-7878: Malicious code in vminfo (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PyPI package vminfo is a software library that provides information about virtual machines. It is commonly used in Python projects to gather details about virtual machine instances. However, a recent security incident has revealed that a specific version of the package has been compromised with malicious code.
Vulnerability Detail
The vulnerability, identified as MAL-2023-7878, originated from a group known as EsqueleSquad. They published nearly 6000 malicious PyPi and NPM packages, including vminfo, which executes spyware and information-stealing malware. The compromised version of vminfo allows attackers to gain unauthorized access to sensitive information and potentially compromise the security of systems that utilize this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall vminfoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to update the package to a secure version as soon as possible.
Conclusion
The PyPI package vminfo has been compromised with malicious code, potentially leading to unauthorized access and data breaches. It is crucial to update the package to a secure version and regularly monitor dependencies for any known vulnerabilities. For further support and assistance in vulnerability remediation, you can contact the Checkmarx security team at DevNack.com.
See every vulnerability recorded for vminfo →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the malicious code in vminfo.
Using the compromised version of vminfo can lead to unauthorized access to sensitive information, data breaches, and potential compromise of the entire system. Attackers can exploit the malicious code to steal valuable data or gain control over the affected systems.
Yes, the Checkmarx security research team has identified the malicious code in the compromised version of vminfo. They have provided detailed information about the origin of the code and the potential risks associated with its usage.
Yes, the EsqueleSquad group has published nearly 6000 malicious PyPi and NPM packages. It is crucial to regularly update and monitor all dependencies in your project to ensure they are not compromised by these malicious packages.
If you have identified the compromised version of vminfo or need further assistance regarding this vulnerability, you can contact the Checkmarx security team at supplychainsecurity@checkmarx.com or visit their website at https://bit.ly/checkmarx-malicious-packages.
