twitter-request-diagnostics

{"schema_version":"1.7.4","id":"MAL-2026-18403","published":"2026-10-29T23:44:17Z","modified":"2026-10-30T12:43:49.671838101Z","summary":"Malicious code in twitter-request-diagnostics (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8ca5b20afc78999f71a79a794a2369cfd98a2c54e4782800d52b18319d8ecb32)\nThe package's init() entrypoint starts an HTTPServer bound to 0.0.0.0:7331 that implements two unauthenticated remote-access primitives against the installer's host. POST to the handler reads a 'q' field from the request body and passes it to os.popen, returning stdout, stderr, and the exit code to the caller; the os.popen lookup is obfuscated as getattr(__import__('os'), 'po' + 'pen') to defeat trivial string/AST scans. GET to the same endpoint returns a JSON blob containing dict(os.environ) plus hostname, user, cwd, and platform, exposing the installer's full environment (including any API keys, database URLs, and cloud credentials it holds) to any party that can reach the port. The /status (or /metrics) path and 'diagnostics' framing in the README do not restrict either behavior, and the package name misrepresents its function. There is no handshake, token, or auth check on either verb, and the bind address makes the listener reachable from every interface, not loopback.\n\n## Source: kam193 (d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1)\nPackage offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-01-rafamarrara-learning-dc\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - exfiltration-env-variables\n","affected":[{"package":{"name":"twitter-request-diagnostics","ecosystem":"PyPI"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"twitter_request_diagnostics/_srv.py","sha256":"d724abab565b2891f185f9df97559e367bec72236d180780fd47459c6ee6c03a","tlsh":"60512499ac9375158717ce7fc405d89a232ead07a60e2529b97d026d6fc8724c1f0efc"}],"package_integrity":[{"filename":"twitter_request_diagnostics-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"3070af49cb7c49bc525a5e4cd1175e4f35628cd45431c843c0a372a9485b0bf7","md5":"7d1c7d37612a1b820d08c6937b09cb80","sha256":"391654b48c3b2db35a0ce61508f25c0c69d07fb87c477e64e76cfe642e7318d1"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/twitter-request-diagnostics"},{"type":"PACKAGE","url":"https://pypi.org/project/twitter-request-diagnostics/1.0.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-test-01-rafamarrara-learning-dc/twitter-request-diagnostics","import_time":"2026-10-30T00:35:16.868899551Z","modified_time":"2026-10-29T23:44:17.225451Z","sha256":"d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1","source":"kam193","versions":["1.0.0"]},{"id":"IN-MAL-2026-022423","import_time":"2026-10-30T12:42:29.642242861Z","modified_time":"2026-10-30T12:28:33Z","sha256":"8ca5b20afc78999f71a79a794a2369cfd98a2c54e4782800d52b18319d8ecb32","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}