dedh-devops-automation

{"schema_version":"1.7.4","id":"MAL-2026-17455","published":"2026-10-02T14:10:14Z","modified":"2026-10-08T06:36:14.468006638Z","summary":"Malicious code in dedh-devops-automation (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722)\nDuring installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-spo365-graph\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-credentials\n\n\n - targetted-attack\n","affected":[{"package":{"name":"dedh-devops-automation","ecosystem":"PyPI"},"versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"dedh_devops_automation-5.8.0.tar.gz","hashes":{"blake2b_256":"8521b18ecddc57145f4f22ab120a7a9b33bbc34b87e6117d47e2709c35fec1e1","md5":"58f6340d6c2c424ffd618bd061b8dc45","sha256":"f84fe73eda26a9984a6ca1f32f1402c5827aec262a6bac4056fcb2dad45fb770"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dedh-devops-automation"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.8.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.6.999/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.8.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/0.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.6.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.9.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/dedh-devops-automation/5.6.1/"}],"database_specific":{"iocs":{"urls":["https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"]},"malicious-packages-origins":[{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T14:21:00.431320376Z","modified_time":"2026-10-02T14:10:14.267008Z","sha256":"e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T14:45:41.977903544Z","modified_time":"2026-10-02T14:41:23.762563Z","sha256":"0d8463c1c6322e355195f7692923e5cb21465185f8df271cd8b21edb3f5242f0","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T15:19:27.45299298Z","modified_time":"2026-10-02T14:41:23.762563Z","sha256":"a911f6efc01eb7a5eb4a1d04d7135d846ba21b6d0926cb51e8274fdab6896709","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T16:20:44.041558225Z","modified_time":"2026-10-02T15:41:38.822027Z","sha256":"66e3f78c24074409feb667c7c3735c8cc99dea2adc35ff0151e12b3dfbcbc7a5","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T16:45:36.201548518Z","modified_time":"2026-10-02T16:38:17.158911Z","sha256":"0d56149d9c6ccbb8dbc39de2b3501bdec1b99071ce70a9649176c0202fb18921","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"IN-MAL-2026-021167","import_time":"2026-10-08T06:34:03.348561842Z","modified_time":"2026-10-08T06:06:35Z","sha256":"35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76","source":"amazon-inspector","versions":["5.8.0"]},{"id":"IN-MAL-2026-021162","import_time":"2026-10-08T06:34:03.058957437Z","modified_time":"2026-10-08T06:05:55Z","sha256":"8fcc07577ab0a145b3daa198d720707ad344e44a919c12686e79cdd5df3ffa1d","source":"amazon-inspector","versions":["5.6.999"]},{"id":"IN-MAL-2026-021164","import_time":"2026-10-08T06:34:03.164618672Z","modified_time":"2026-10-08T06:06:10Z","sha256":"979dd29ac3bbf58a1dff9b5c66504d35bb8d5ee6877690f65c4373548b040c79","source":"amazon-inspector","versions":["5.8.1"]},{"id":"IN-MAL-2026-021171","import_time":"2026-10-08T06:34:03.566708801Z","modified_time":"2026-10-08T06:07:06Z","sha256":"c3d88d6c849c5614450c58367dcea9bb7923e2e2c8bdb27a3d54952823215c7f","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-021170","import_time":"2026-10-08T06:34:03.515903386Z","modified_time":"2026-10-08T06:06:59Z","sha256":"d6c064428219526341c09cf3af14dc377e774acbe9ab08c97f04d944dccf7c6b","source":"amazon-inspector","versions":["5.0.0"]},{"id":"IN-MAL-2026-021168","import_time":"2026-10-08T06:34:03.396296061Z","modified_time":"2026-10-08T06:06:43Z","sha256":"e9f27defc8cf46bd2d5b63d603afd365fc05bde05389511b126f8a521d7b8b1c","source":"amazon-inspector","versions":["5.6.0"]},{"id":"IN-MAL-2026-021165","import_time":"2026-10-08T06:34:03.245535024Z","modified_time":"2026-10-08T06:06:19Z","sha256":"fa25f003a500a91134e1a09f96c65d3f084e6afb99b27f71576d8e16399b34ca","source":"amazon-inspector","versions":["5.9.0"]},{"id":"IN-MAL-2026-021166","import_time":"2026-10-08T06:34:03.296283691Z","modified_time":"2026-10-08T06:06:28Z","sha256":"33bcc6394e606c102a4239701b7383ef8749678003f721d2e7381ee45b7a67dd","source":"amazon-inspector","versions":["5.6.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}