fontus

{"schema_version":"1.7.4","id":"MAL-2026-18271","published":"2026-10-25T10:58:27Z","modified":"2026-10-29T14:38:27.606747448Z","summary":"Malicious code in fontus (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bb5b8b4484126f787f9917d91b6815927146a308f64bfb852c57f5d60bf4bfbb)\nAnalysis of fontus 0.0.3 on PyPI did not identify any code paths that exfiltrate installer data, execute attacker-controlled payloads at install or import time, relay caller-supplied data to third-party destinations, distribute live credentials, or establish persistence. No install-time network fetches, no lifecycle shell execution, no reads of credential paths (~/.aws, ~/.ssh, ~/.npmrc, browser profiles), and no obfuscated or dynamic-exec patterns were observed.\n\n## Source: kam193 (2a8fcff0fd4d827c6f174318ee41ea82eb2667c6d65349a01ca2215aa2f4dd5e)\nThe package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-fontus\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n","affected":[{"package":{"name":"fontus","ecosystem":"PyPI"},"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"fontus-0.0.2-py3-none-any.whl","hashes":{"blake2b_256":"d413d9d70bf221a21c1f025a0dfcb3da4b40ac5c9d435ef7ae0c0b8ec086c88d","md5":"8507106768b81043ea1c55e3fe8bc419","sha256":"ddae02c27b4ffbe07de2d7f9eef7545ac276adc59a162a6af9c57c48aa4ff880"}},{"filename":"fontus-0.0.2.tar.gz","hashes":{"blake2b_256":"52b1698b89e681241ac5d7eaa88183057b5917c37bb0cc3d4706826d59830d8a","md5":"81bd9da21017b19dac34d9532b917af3","sha256":"f9ae348e7776353d721c08560b6855c1d214c47ba71760071d8ece7be71d913a"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/fontus"},{"type":"PACKAGE","url":"https://pypi.org/project/fontus/0.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/fontus/0.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/fontus/0.0.3/"}],"database_specific":{"iocs":{"domains":["conservative-execute-shoulder-innovation.trycloudflare.com","ci-collector.andy-827.workers.dev","remind-eos-standard-cds.trycloudflare.com"]},"malicious-packages-origins":[{"id":"pypi/2026-10-fontus/fontus","import_time":"2026-10-25T11:15:02.932024538Z","modified_time":"2026-10-25T10:58:27.245929Z","sha256":"2a8fcff0fd4d827c6f174318ee41ea82eb2667c6d65349a01ca2215aa2f4dd5e","source":"kam193","versions":["0.0.1","0.0.2","0.0.3"]},{"id":"IN-MAL-2026-022304","import_time":"2026-10-29T14:37:02.93140606Z","modified_time":"2026-10-29T14:15:21Z","sha256":"9b559621509033bbaef36487f789d3e4033a01de2e2a91c33e6eb8ef21b1c06a","source":"amazon-inspector","versions":["0.0.2"]},{"id":"IN-MAL-2026-022305","import_time":"2026-10-29T14:37:02.988706989Z","modified_time":"2026-10-29T14:15:30Z","sha256":"aed24fef32cb98f6ad5135c431785a0e7ab6bc27335f814a776b1ce7503137ef","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-022306","import_time":"2026-10-29T14:37:03.021476109Z","modified_time":"2026-10-29T14:15:37Z","sha256":"bb5b8b4484126f787f9917d91b6815927146a308f64bfb852c57f5d60bf4bfbb","source":"amazon-inspector","versions":["0.0.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}