dash-grid-normalizer

{"modified":"2026-06-13T02:25:12Z","published":"2026-06-13T01:03:41Z","schema_version":"1.7.4","id":"MAL-2026-5725","summary":"Malicious code in dash-grid-normalizer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a)\nOn import, src/dash_grid_normalizer/__init__.py calls _hydrate_remote_layout_profile(), which reassembles a payload from four string segments, base64-decodes and zlib-decompresses it, and passes the result to builtins.exec(). The decoded Python source imports os/socket/subprocess, connects a TCP socket to 43.69.137.236:80, dup2's stdin/stdout/stderr onto the socket, and execs /bin/sh — a standard reverse shell granting the operator of that IP interactive command execution as the installer's user. The C2 IP literal is itself further obfuscated as bytes([52,51,46,...]). The package's pyproject description (\"Responsive grid and gutter helpers for dashboard widget layouts\") and name are cover; the README self-identifies the project as a pentest probe with the reverse shell \"LIVE CONFIRMED\". Any process that does `import dash_grid_normalizer` (including transitive imports during test or build) opens the shell.\n\n## Source: kam193 (b27c5f3eaf2e7f704830efee579b0a413695540736da93bc3219bfda4afecc79)\nDuring import, the package starts a reverse shell.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-acme-widget-layout-utils\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n","affected":[{"package":{"ecosystem":"PyPI","name":"dash-grid-normalizer"},"versions":["0.0.2","0.0.1","0.0.5","0.0.3","0.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dash_grid_normalizer/__init__.py","sha256":"c5eda0598aafe1afd00a38cac2b8d2381c9dfb1a3145ac49fa3b0f3484fdb71b","tlsh":"5b2105c6e9399516a727e222a4c39d13774d5947568c28f13f7e42246f130b985b1cdc"},{"path":"dash_grid_normalizer-0.0.2.dist-info/METADATA","sha256":"7dbeb712d3b98a8c4e223577ec3044f91294913d73027c197c13a81846c92ac9","tlsh":"3c81a8558cb215e225e3c553b5f27690efb2c66360c57c38eca84f586e981d8623f32e"}],"ips":["43.69.137.236"],"package_integrity":[{"filename":"dash_grid_normalizer-0.0.5-py3-none-any.whl","hashes":{"blake2b_256":"bb9745d86ee8477c3d85053d1fcb8e218909baa4b4d3507943d8157c7b072e67","md5":"ceb58abdad111e1cecd53aeb74937395","sha256":"aafdb8d2dc08adfbf7acaaec0b0d26fe2b031c8b6c2e36dc08342ca1ee28edb0"}},{"filename":"dash_grid_normalizer-0.0.5.tar.gz","hashes":{"blake2b_256":"df6319c10d492eb55f24fe531c14bcd471bba54dd600ab0843578f895db4be56","md5":"0c9ea518670afdb11e9f5b5654e5d4d6","sha256":"737debcd0ce92b13b2a9251506b097d49e9bd2784bc440bf93266e53a94b28fa"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/dash-grid-normalizer/0.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/dash-grid-normalizer/0.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/dash-grid-normalizer/0.0.5/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dash-grid-normalizer"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"ips":["34.69.137.236"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-006265","import_time":"2026-06-13T02:23:22.435836615Z","modified_time":"2026-06-13T01:25:12Z","sha256":"33e2cf264a51ab03d244b5226d2ebdced0eaa0c09c462291f9bbdd75410152f1","source":"amazon-inspector","versions":["0.0.2"]},{"id":"IN-MAL-2026-006267","import_time":"2026-06-13T02:23:22.669477096Z","modified_time":"2026-06-13T01:25:17Z","sha256":"362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-006268","import_time":"2026-06-13T02:23:22.774725831Z","modified_time":"2026-06-13T01:25:17Z","sha256":"56fb3ee9db44cb577a1f92a596d4da7dce1fba88cc4d710c4f920bc364f3004f","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-006270","import_time":"2026-06-13T02:23:23.000654355Z","modified_time":"2026-06-13T01:25:19Z","sha256":"c4a2ff66920eded5c1f2382ac0edb486e56ee0ce9a9ecc019a4e3dc74a6d3f55","source":"amazon-inspector","versions":["0.0.5"]},{"id":"IN-MAL-2026-006266","import_time":"2026-06-13T02:23:22.582878612Z","modified_time":"2026-06-13T01:25:14Z","sha256":"f1367e40c183e27f5273b136155f08a27f5f8c90991560d24c4ef4d44f14d3a2","source":"amazon-inspector","versions":["0.0.2"]},{"id":"IN-MAL-2026-006269","import_time":"2026-06-13T02:23:22.900588122Z","modified_time":"2026-06-13T01:25:19Z","sha256":"faf62dd8a16c6f5112e302a14e484cd3261532d2c1c6cc1cf53c73eee4f9e6ad","source":"amazon-inspector","versions":["0.0.5"]},{"id":"pypi/2026-06-acme-widget-layout-utils/dash-grid-normalizer","import_time":"2026-06-13T02:23:25.583981987Z","modified_time":"2026-06-13T01:03:43.580551Z","sha256":"b27c5f3eaf2e7f704830efee579b0a413695540736da93bc3219bfda4afecc79","source":"kam193","versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5"]}]}}