salesforce-sysutils-diagnostics

{"modified":"2026-06-15T18:56:56Z","published":"2026-06-13T21:38:10Z","schema_version":"1.7.4","id":"MAL-2026-5754","summary":"Malicious code in salesforce-sysutils-diagnostics (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (59e4ce1338f2439a1a5b2d257b96aadaef4a9c2883f6787343856728514bd148)\nsetup.py unconditionally invokes curl at install time to POST the contents of /tmp/fake-keys.json to https://webhook.site/20ed745d-ee73-4b79-ab06-5b106255c38c, an anonymous request-capture endpoint. stderr is redirected to DEVNULL to suppress install-time output. The package additionally impersonates the Salesforce brand (name 'salesforce-sysutils-diagnostics') with no Author or Home-page metadata in PKG-INFO, consistent with a brand-confusion lure. Any developer or build system that runs `pip install salesforce-sysutils-diagnostics` will trigger an outbound POST to the attacker-controlled webhook on every install.\n\n## Source: kam193 (df69f7ee7e4cb191b719367d5d707c8c244f50c35d1af182e5b9cec73dd1937c)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"ecosystem":"PyPI","name":"salesforce-sysutils-diagnostics"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"8b8452f6d7ac3bf9d4e6da918d4d682f1cb107c1e2adc60c3fd567122215718c","tlsh":"75e0e5b2cb1b5b611980a232688e544a5ff2c20bcb1679f5718946b41f8d228da35434"},{"path":"PKG-INFO","sha256":"6034320c5aa02598cd213e75f907b80809bce26c4e13c3cb286f4706fbc33664","tlsh":"1bc09b51a70145b71e11774755ad9fd1d1e7c30d126a11f6845b2775434726d8615030"}],"ips":["151.101.128.223","151.101.0.223","10.1.0.2","151.101.64.223"],"package_integrity":[{"filename":"salesforce_sysutils_diagnostics-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"9f7fcb22264f50f5885897d6e584ebf6b0bb5ccce854e7394581e9cf16d19617","md5":"491ef8f40f84f89e9e5ec33ab5f409bc","sha256":"6fd70875e4b0a4dbfe79e40da3c451bb93da8139e2454ff73e9ae82ad12ece2e"}},{"filename":"salesforce_sysutils_diagnostics-0.1.0.tar.gz","hashes":{"blake2b_256":"1155c63b3bb3ea71a3abeb82d38b0a652abbdeabfb2f928a90459e185f783eca","md5":"ed4bff58ba168a6ca0b0c96db64daf6e","sha256":"e14225ba42a4385812ed37882da14650dfc72dd1b85170cd0f243319272f1c40"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/salesforce-sysutils-diagnostics"},{"type":"PACKAGE","url":"https://pypi.org/project/salesforce-sysutils-diagnostics/0.1.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"malicious-packages-origins":[{"source":"kam193","sha256":"df69f7ee7e4cb191b719367d5d707c8c244f50c35d1af182e5b9cec73dd1937c","import_time":"2026-06-13T22:27:38.933874743Z","id":"pypi/GENERIC-standard-pypi-install-pentest/salesforce-sysutils-diagnostics","modified_time":"2026-06-13T21:38:10.05027Z","versions":["0.1.0"]},{"source":"amazon-inspector","sha256":"59e4ce1338f2439a1a5b2d257b96aadaef4a9c2883f6787343856728514bd148","import_time":"2026-06-15T18:54:56.562573747Z","id":"IN-MAL-2026-006660","modified_time":"2026-06-15T18:48:13Z","versions":["0.1.0"]},{"source":"amazon-inspector","sha256":"f7c37a22e941d37810aecad4c26a58e003977e4ca1715d733c99b1d7863debcf","import_time":"2026-06-15T18:54:56.591468303Z","id":"IN-MAL-2026-006661","modified_time":"2026-06-15T18:48:13Z","versions":["0.1.0"]}]}}