PT-2024-40899 · Pypi · Aiocpa

Published 2024-11-25 · Updated 2024-11-25

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions aiocpa versions prior to the removal from PyPI

Description The issue concerns a user-facing library used for generating color gradients of text. It was discovered that version 0.1.13 introduced obfuscated, malicious code. This code targets Crypto Pay users and forwards client credentials to a remote Telegram bot.

Recommendations For all affected versions, there is no information about a newer version that contains a fix for this issue, as all versions have been removed from PyPI.

Related Identifiers

PYSEC-2024-152

Affected Products

Aiocpa

References · 3

• https://osv.dev/vulnerability/PYSEC-2024-152 · Vendor Advisory
• https://inspector.pypi.io/project/aiocpa/0.1.13/packages/ab/98/7343281068a2c39086d0b877219668a487508197f46e89b3f41046a4a8ba/aiocpa-0.1.13.tar.gz/aiocpa-0.1.13/cryptopay/utils/sync.py#line.44 · Note
• https://blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis · Note