MAL-2026-15934 Malicious code in dbt-sa-cli (PyPI)

setup.py defines rce_poc() and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects installer-side identifiers (hostname, USER/USERNAME, current working directory, home path) and sends them out-of-band via a DNS lookup to a subdomain of yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun and an HTTPS POST to https://yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun/dbt-sa-cli. The same install-time path drops a marker file at ~/.dbt-sa-cli-rce-poc in the installer's home directory, demonstrating arbitrary code execution during install. The package name resembles the dbt ecosystem, making this a typosquat lure. Regardless of any 'security research' framing, installing the package produces immediate installer-side data disclosure and code execution against an author-controlled OOB collector.

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.