MAL-2024-11575 Malicious code in dftester-pip (PyPI)

Example package with overwritten install command and the reverse shell

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2024-11-dftester-pip

Reasons (based on the campaign):

• The package overrides the install command in setup.py to execute malicious code during installation.

• The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.