MAL-2026-17455

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dedh-devops-automation/MAL-2026-17455.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-17455
Published
2026-10-02T14:10:14Z
Modified
2026-10-02T17:00:03Z
Summary
Malicious code in dedh-devops-automation (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722)

During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-spo365-graph

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-cloud-tokens

  • exfiltration-credentials

  • targetted-attack

Database specific 
{
    "iocs": {
        "urls": [
            "https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time": "2026-10-02T14:21:00.431320376Z",
            "modified_time": "2026-10-02T14:10:14.267008Z",
            "sha256": "e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id": "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time": "2026-10-02T14:45:41.977903544Z",
            "modified_time": "2026-10-02T14:41:23.762563Z",
            "sha256": "0d8463c1c6322e355195f7692923e5cb21465185f8df271cd8b21edb3f5242f0",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id": "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time": "2026-10-02T15:19:27.45299298Z",
            "modified_time": "2026-10-02T14:41:23.762563Z",
            "sha256": "a911f6efc01eb7a5eb4a1d04d7135d846ba21b6d0926cb51e8274fdab6896709",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id": "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time": "2026-10-02T16:20:44.041558225Z",
            "modified_time": "2026-10-02T15:41:38.822027Z",
            "sha256": "66e3f78c24074409feb667c7c3735c8cc99dea2adc35ff0151e12b3dfbcbc7a5",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id": "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time": "2026-10-02T16:45:36.201548518Z",
            "modified_time": "2026-10-02T16:38:17.158911Z",
            "sha256": "0d56149d9c6ccbb8dbc39de2b3501bdec1b99071ce70a9649176c0202fb18921",
            "source": "kam193",
            "versions": [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / dedh-devops-automation

Package

Name
dedh-devops-automation
View open source insights on deps.dev
Purl
pkg:pypi/dedh-devops-automation

Affected ranges

Affected versions

0.*
0.0.1
5.*
5.0.0
5.6.0
5.6.1
5.6.999
5.8.0
5.8.1
5.9.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dedh-devops-automation/MAL-2026-17455.json"