MAL-2026-3413 Malicious code in django-b64-img (PyPI)

The package provides a special image-storing field for Django REST Framework based on a legitimate implementation from the Hipo/drf-extra-fields repository. The malicious modification appends the cloud credentials and full settings values to the serialized form of specific image types. This way, an attacker can retrieve sensitive values by downloading back once uploaded image.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-old-django-b64-img

Reasons (based on the campaign):

• exfiltration-credentials

• obfuscation

• backdoor