Malicious Package Affecting deep-translator package, versions [1.8.5]


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-DEEPTRANSLATOR-2994413
  • published28 Aug 2022
  • disclosed26 Aug 2022
  • creditUnknown

Introduced: 26 Aug 2022

Malicious CVE NOT AVAILABLE CWE-506  (opens in a new tab)

How to fix?

Avoid using all malicious instances of the deep-translator package.

Overview

deep-translator is a malicious package. The project on PyPI was taken over via a phishing attack and included a specific malicious release, which contained a malicious code that collects environment variables and downloads malware at install time.

Note: The malicious versions were removed from PyPI.

CVSS Base Scores

version 3.1