boto4

{"schema_version":"1.7.4","id":"MAL-2026-14349","published":"2026-08-21T08:19:49Z","modified":"2026-08-21T14:49:38.494127103Z","summary":"Malicious code in boto4 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa)\nsetup.py defines a custom setuptools install command (`EjecutaElf`) that base64-decodes a ~17MB embedded Linux ELF, writes it to /tmp/.systemd-helper, chmods 0755, and spawns it via subprocess.Popen during `pip install` on Linux. The tarball's importable package is a stub named `reques` with an empty __init__.py, and PKG-INFO advertises the project as an `HTTP library for humans (unofficial fix)` authored by `Anonymous`, requiring `requests` — a cover story that lures installers looking for a requests-related fix while the sole functional behavior is native-code execution on the installer's host at install time. Package name `boto4` and internal directory `reques` are lookalikes for boto3/requests.\n\n## Source: kam193 (b928f1f0d3af6242391cc626a8601d24f60c70d862bfebe6cfe0777c13a8c0b2)\nDuring installation, package executes an embedded executable. The executable is capable of executing remote commands, establishing persistence, cryptomining, exfiltrating basic data, further network scanning and worm-style propagation. Actions are controlled via a Telegram bot.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-boto4\n\n\nReasons (based on the campaign):\n\n\n - cryptominer\n\n\n - worm\n\n\n - network-scan\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - uses-telegram-bot\n\n\n - persistence\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n","affected":[{"package":{"name":"boto4","ecosystem":"PyPI"},"versions":["1.0.0","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"92fbc7e725673fe4c8423fddcd8173fd02d2753ca08c00b7365f100fa21eecc5","tlsh":"ac3733309e667dba07bcc725703f6e1c0fb01f93888df5eb529064d716aab90495b82d"},{"path":"reques/__init__.py","sha256":"072590736ca7eac1013e80081a8c698187549723064b53755c0639ac5fcc15bd"}],"package_integrity":[{"filename":"boto4-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"7949164dd2e533c8497c4b5975f3692f65f057393b99e0e3bb343ad450050cb7","md5":"b6d003ac7505c3eb12307a0389be948a","sha256":"8747b1e051e2b49fa6f7f223244e3e13afe6b7db59f82eb72706bb9ff83917c4"}},{"filename":"boto4-1.0.0.tar.gz","hashes":{"blake2b_256":"8bfb5e3ab10a501d91546d6e92327ad328baea402235fe6227d99018e98e9eaa","md5":"cded3ffea3cc4b24733f8de3676c066c","sha256":"b0a351d43ea3c85579fb81c464ccbb3a14382db58deb7e567281cc85a0039be7"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/boto4"},{"type":"PACKAGE","url":"https://pypi.org/project/boto4/1.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/boto4/1.0.2/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-08-boto4/boto4","import_time":"2026-08-21T08:49:03.94191658Z","modified_time":"2026-08-21T08:19:49.132984Z","sha256":"b928f1f0d3af6242391cc626a8601d24f60c70d862bfebe6cfe0777c13a8c0b2","source":"kam193","versions":["1.0.0","1.0.2"]},{"id":"IN-MAL-2026-018503","import_time":"2026-08-21T14:47:43.231496994Z","modified_time":"2026-08-21T14:24:42Z","sha256":"321d077c86a0b0896e336bc4e3291381c38fd0d4bccbfbe8102ec3264c6c560a","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-018505","import_time":"2026-08-21T14:47:43.527649233Z","modified_time":"2026-08-21T14:24:59Z","sha256":"d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa","source":"amazon-inspector","versions":["1.0.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}