websetup

{"schema_version":"1.7.4","id":"MAL-2026-16121","published":"2026-09-09T14:00:00Z","modified":"2026-09-10T18:22:48.001236972Z","summary":"Malicious code in websetup (PyPI)","details":"websetup@0.1.0 is a single module whose only function, setup.set(text=None, file_path=None) in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook (id 1546817174411288617; the name Discord returns for it is \"backdoor\") and swallows every exception. Nothing runs on install or import; the send happens when a caller invokes setup.set(). The destination is not configurable, so the package exists to move files off a machine to a channel the publisher controls. The Discord URL is listed under urls only.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e57a4e728de92fb3c7d7693551dec707f4b4c3a92bc1c9eff30eab0f92ac2d93)\nThe package exposes a single public API, websetup.setup.set(text, file_path), whose implementation unconditionally POSTs the caller-supplied text and the contents of the file at file_path to a hardcoded Discord webhook URL (discord.com/api/webhooks/1546817174411288617/...). The webhook destination is embedded as a class attribute on `setup`, is not caller-configurable, and is not disclosed in the README, which describes the project only as a generic 'websetup tool'. Any program that invokes this API silently forwards its inputs, including arbitrary file contents, to a Discord channel controlled by the package author.\n","affected":[{"package":{"name":"websetup","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"websetup/sender.py","sha256":"b80e0ce620cc149b09ebfcf9ac46f62fbbd43d84c55d04dfb9eaf8551e982a07","tlsh":"e50149da3d803122d142f2ec6fa4b4592600f8bf69095434bddcb9907f9913163e97bc"}],"package_integrity":[{"filename":"websetup-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"d65323594ff94b04eaf465fb7df137a3b6799d99b7cee793df92679914fd07a2","md5":"456524c93c76f017cec345f9ef53a1d5","sha256":"7045ec46d4776636ba84e267d6df701937e68b20f7a9093b50b317f7c5906e7a"}},{"filename":"websetup-0.1.0.tar.gz","hashes":{"blake2b_256":"fda5e5cdf67b381e98dd47a0f58030429a12bb3b59c5f343a367595ab61a83f1","md5":"6cbcf7df632f98f68fa9b9146ffc7a4c","sha256":"f67af28e598e691e60751e2c81afffccb1a521b1f658bac773ead55aa1924dcf"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/websetup/"},{"type":"PACKAGE","url":"https://pypi.org/project/websetup/0.1.0/"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"b80e0ce620cc149b09ebfcf9ac46f62fbbd43d84c55d04dfb9eaf8551e982a07"},"note":"setup.set() POSTs text and file contents to a hardcoded Discord webhook","paths":["websetup/sender.py"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://discord.com/api/webhooks/1546817174411288617/gSM929JI3dTZ7Lep9OHfIPgzmadYRJVuLPL4DN0oRNmlxYyrWFPXVOX3WrKYYIt-NCeB"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-019953","import_time":"2026-09-10T18:20:43.202966581Z","modified_time":"2026-09-10T18:10:33Z","sha256":"e57a4e728de92fb3c7d7693551dec707f4b4c3a92bc1c9eff30eab0f92ac2d93","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}