MAL-2024-12269

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/faest/MAL-2024-12269.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-12269
Published
2024-09-25T16:44:30Z
Modified
2025-12-12T20:38:51.886096Z
Summary
Malicious code in faest (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781)

When using this library to do any request, a "validate_origin" function is called (L1320 in _client.py). This method, located in _utils.py, collects all request data, tries also read /etc/shadow using Docker container, and sends them to an endpoint controlled by the package author.

The package seems to be a clone of httpx and also informs in the README that it's a malicious library, as so, it seems to be a malicious research attempts.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-09-old-faest

Reasons (based on the campaign):

  • exfiltration-generic

  • action-hidden-in-lib-usage

  • clones-real-package

Database specific 
{
    "iocs": {
        "domains": [
            "donkeyback.glitch.me"
        ],
        "urls": [
            "https://donkeyback.glitch.me/metrics/collect",
            "https://git.sr.ht/~wsmith/faest"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "modified_time": "2024-09-25T16:44:30Z",
            "sha256": "f14be620ed15757151031493799128ccd109c45077a8f9864ab8a9b2c0a8a0c1",
            "id": "pypi/2024-09-old-faest/faest",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T22:30:55.181324923Z"
        },
        {
            "source": "kam193",
            "modified_time": "2024-09-25T16:44:30Z",
            "sha256": "f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781",
            "id": "pypi/2024-09-old-faest/faest",
            "ranges": [
                {
                    "type": "ECOSYSTEM",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "import_time": "2025-12-02T23:07:18.189436981Z"
        },
        {
            "versions": [
                "0.14.6"
            ],
            "modified_time": "2024-09-25T16:44:30Z",
            "sha256": "4b9b50f96aa5c969ee30095a332d27eb0bc4ac15eaaab90e910a9c9c7f7f7e28",
            "id": "pypi/2024-09-old-faest/faest",
            "source": "kam193",
            "import_time": "2025-12-10T21:38:57.473453578Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / faest

Package

Name
faest
View open source insights on deps.dev
Purl
pkg:pypi/faest

Affected ranges

Affected versions

0.*
0.14.6

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/faest/MAL-2024-12269.json"