MAL-2024-12269 Malicious code in faest (PyPI)
- Package
- faest
- Registry
- PyPI
What is MAL-2024-12269?
MAL-2024-12269 is a malicious package in faest, published on 25 Sep 2024.
Official description
When using this library to do any request, a "validate_origin" function is called (L1320 in _client.py). This method, located in _utils.py, collects all request data, tries also read /etc/shadow using Docker container, and sends them to an endpoint controlled by the package author.
The package seems to be a clone of httpx and also informs in the README that it's a malicious library, as so, it seems to be a malicious research attempts.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-old-faest
Reasons (based on the campaign):
exfiltration-generic
action-hidden-in-lib-usage
clones-real-package
What should I do about MAL-2024-12269?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.