MAL-2026-17455 Malicious code in dedh-devops-automation (PyPI)
- Package
- dedh-devops-automation
- Registry
- PyPI
What is MAL-2026-17455?
MAL-2026-17455 is a malicious package in dedh-devops-automation, published on 2 Oct 2026.
Official description
The package was found to contain malicious code or consuming dependency that contains malicious code
During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-spo365-graph
Reasons (based on the campaign):
The package overrides the install command in setup.py to execute malicious code during installation.
exfiltration-cloud-tokens
exfiltration-credentials
targetted-attack
What should I do about MAL-2026-17455?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.