fabdeploycheck

{"schema_version":"1.7.4","id":"MAL-2026-17926","published":"2026-10-19T02:26:39Z","modified":"2026-11-08T00:35:27.874497796Z","summary":"Malicious code in fabdeploycheck (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857)\nThe package's only public API, check(), spawns a Python child that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json using ssl._create_unverified_context() and dispatches handlers under remote control. A 'revsh' handler double-forks + setsid to daemonize, polls <base>/<id>-cmd.txt for commands, executes each fetched string via /bin/sh -c, and PUTs stdout/stderr back as <id>-out.txt — a full reverse-shell channel on the installer host. Additional handlers permit arbitrary file reads (kind='file' opens any path on disk), arbitrary process execution (kind='run' with attacker-supplied argv), TCP probing (kind='tcp'), and HTTP calls with Bearer tokens chained from previously-read files (kind='http'); collected results are zipped and PUT to the same anonymous file host under an attacker-chosen report name. Before launching the daemon the child walks /proc and SIGKILLs any process whose cmdline contains 'FABDRV3', 'fabdrv2', or 'connection ready' — housekeeping to replace prior implant generations and consistent with a self-named, iterated backdoor family. The control URL is anonymous, mutable, and reached with TLS verification disabled, so the operator of that path (or any MITM) obtains unauthenticated code execution on every host that invokes check().\n\n## Source: kam193 (3340a19275f536b55758d9924efaaf0307c746dec054b46fbdfac72b4d0e0a90)\nPackage hides code that starts malicious actions: it downloads a C2 configuration and executes commands from it. It supports exfiltrating files, running commands, and starting a reverse shell.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-fabtoolkit\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - exfiltration-generic\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n","affected":[{"package":{"name":"fabdeploycheck","ecosystem":"PyPI"},"versions":["0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"fabdeploycheck/__init__.py","sha256":"96161cb2ff7d91e1b156242ea76bd1ae2dbc02395e7139194c59820f59fd6d9a","tlsh":"32e16312981a2472d283e53cac30c9567b56fd1b91039c717edc9ba49fc84b7c1b27ba"}],"package_integrity":[{"filename":"fabdeploycheck-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"21c92fce4dde9d7660fb8134532d516f594092bca68de73e33915e2b3167c7ff","md5":"b32250d58a656d5b8dde3262de0b4286","sha256":"24cb59b96fdffe19dab2eae7903c2d15f00ef9f9d385507544e3d5b581596609"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/fabdeploycheck/0.1.1/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/fabdeploycheck"}],"database_specific":{"iocs":{"urls":["https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021524","import_time":"2026-10-19T02:27:23.751305115Z","modified_time":"2026-10-19T02:26:39Z","sha256":"73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857","source":"amazon-inspector","versions":["0.1.1"]},{"id":"pypi/2026-11-fabtoolkit/fabdeploycheck","import_time":"2026-11-08T00:33:31.780717234Z","modified_time":"2026-11-07T23:28:38.111587Z","sha256":"3340a19275f536b55758d9924efaaf0307c746dec054b46fbdfac72b4d0e0a90","source":"kam193","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}