MAL-2026-15566

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flask-header-guard/MAL-2026-15566.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15566
Published
2026-08-29T11:29:06Z
Modified
2026-08-29T23:30:10.932498727Z
Summary
Malicious code in flask-header-guard (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8)

The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the library is imported into a Flask app. setup.py overrides the install cmdclass with PostInstallCommand, which base64-decodes an embedded blob and exec()s it in a detached child process during pip install. The payload's collectdata() enumerates os.environ for variables matching API/TOKEN/KEY/SECRET/PASS/CRED/AUTH/AWS/AZURE/GCP/OPENAI/ANTHROPIC/MANUS and reads /etc/passwd, /etc/shadow, /etc/sudoers, /root/.bashhistory, /etc/hosts, and /var/log/auth.log into /tmp/.sandboxdata.json. persistcron() drops /tmp/.fhgrecon.py — a reverse-shell loop to C2HOST=smat7ckgzo.localto.net C2PORT=6303 — and installs a per-minute crontab entry to relaunch it. persistsudo() writes <user> ALL=(ALL) NOPASSWD: ALL to /etc/sudoers.d/.fhg for passwordless root when the install runs with sufficient privileges. initsecurity(), invoked when any Flask app imports flaskheader_guard, registers a hidden route /api/v1/monitor/system gated only by query parameter k=lo that executes shell commands via subprocess.run(shell=True), reads arbitrary files, lists directories, accepts file uploads, and serves a shell UI — unauthenticated RCE on every downstream Flask deployment. The declared purpose (security headers) is a cover story for combined credential theft, persistent C2, local privilege escalation, and a shipped web backdoor.

Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb)

During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pygame-renderkit

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

  • files-exfiltration

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-env-variables

  • persistence

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-pygame-renderkit/flask-header-guard",
            "source": "kam193",
            "import_time": "2026-08-29T11:38:14.179490451Z",
            "modified_time": "2026-08-29T11:29:06.658101Z",
            "sha256": "cd3723cc33d785f71f78562c97be24288c5b49cb4cb043fc46af03d6a18706d5",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "pypi/2026-08-pygame-renderkit/flask-header-guard",
            "modified_time": "2026-08-29T11:29:06.658101Z",
            "import_time": "2026-08-29T12:23:15.004831568Z",
            "source": "kam193",
            "sha256": "d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019153",
            "modified_time": "2026-08-29T23:11:16Z",
            "import_time": "2026-08-29T23:14:43.901884739Z",
            "source": "amazon-inspector",
            "sha256": "e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8",
            "versions": [
                "1.0.0"
            ]
        }
    ],
    "iocs": {
        "domains": [
            "5uj0a8ziyu.localto.net"
        ]
    }
}
References
Credits

Affected packages

PyPI / flask-header-guard

Package

Name
flask-header-guard
View open source insights on deps.dev
Purl
pkg:pypi/flask-header-guard

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "flask_header_guard-1.0.0-py3-none-any.whl",
            "hashes": {
                "md5": "b9a928d3acab3e683d18b0a70129a550",
                "blake2b_256": "72f49fc32bf94dbc4fe03ae0cb3e8f150192db92793e3152794d38d58144fde8",
                "sha256": "bf2750b05104cc7086ead36347dab04a5543f410abee4e2514bdae4cd6964b03"
            }
        },
        {
            "filename": "flask_header_guard-1.0.0.tar.gz",
            "hashes": {
                "md5": "6415bf34518bd6b64ef86ee5e665777a",
                "blake2b_256": "b5c87c3769abf0e7e66c367a0d60a3105961e7210242a233a91b82f62d12a1ab",
                "sha256": "53572cb6a8b3d8f1979b936f5d4cc34d5f742ee05f9a95b5d81dfd1860dc3baf"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "setup.py",
            "tlsh": "dda1b696d89c1234c7c389ab411a90521bd6b42b5e029cb4befd93549fce03962f93bd",
            "sha256": "f284e0febbfa783b425c55878a30a8d968f3ce73d927b2a7fe73054d7a54eab2"
        },
        {
            "path": "flask_header_guard/backdoor.py",
            "tlsh": "ef6101619d96a201c3aaf76c4ab9c0856304fe6fe20d5935fd8c966cbf40330c9f0ad9",
            "sha256": "4752197ab64b8a790a7881b4d372ac7b8e9cd59586f3b9ac7cc69cf4e0db928e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flask-header-guard/MAL-2026-15566.json"