MAL-2026-17421

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spo365-graph/MAL-2026-17421.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17421
Published
2026-10-01T18:58:14Z
Modified
2026-10-08T20:30:04Z
Summary
Malicious code in spo365-graph (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b)

SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365_GRAPH/SPO365_GRAPH.py consists entirely of stub methods returning placeholder values; all real logic lives in setup.py and executes at install time. On pip install, setup.py decodes a zlib+base64 blob (_SERVICE_CONFIG) into a configuration dict holding an AWS STS endpoint, a hardcoded RoleArn, an RSA public key, upload/webhook URLs, a proxy host, and an embedded Lambda source. It then reads ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN from the environment, requests a GitHub Actions OIDC JWT with audience sts.amazonaws.com, and calls STS AssumeRoleWithWebIdentity against the attacker's hardcoded RoleArn to obtain temporary credentials under the attacker's trust policy. Using those credentials it submits a CloudFormation CreateStack request whose TemplateBody embeds an AWS::Lambda::Function with Code.ZipFile sourced from the obfuscated config (_cfg['vs']) and a hardcoded role/function name, polls DescribeStacks for Outputs, then base64-decodes the collected outputs, wraps them with hybrid RSA-OAEP + AES-256-CBC using the embedded public key, and uploads the ciphertext via PUT to _cfg['ru'] with a POST fallback to _cfg['fu'], optionally through a hardcoded HTTP proxy at _cfg['px']. Author metadata is a disposable proton.me address. The naming, stub library, and obfuscation of every operational parameter are a cover story for a CI/CD-targeted OIDC-to-AWS credential abuse and remote-code-execution dropper.

Source: kam193 (ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1)

During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated. The malicious code was introduced in version 1.1.2.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-spo365-graph

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-cloud-tokens

  • targetted-attack

  • exfiltration-credentials

Database specific 
{
    "iocs":  {
        "urls":  [
            "https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-01T19:40:24.541905041Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-02T14:21:00.466042478Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "5fef22ae28edcff38a319610223e2d0691c92bf11e472adfa5c6d892d62bc77f",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-02T15:19:27.463736704Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "7c7ffd80d861a96fdf27359d7bc4003cdffc862ddbff6ec08ac433bb8d94eea2",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-021232",
            "import_time":  "2026-10-08T20:20:20.308907984Z",
            "modified_time":  "2026-10-08T20:02:15Z",
            "sha256":  "091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / spo365-graph

Package

Name
spo365-graph
View open source insights on deps.dev
Purl
pkg:pypi/spo365-graph

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.1.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "ed2469abf06d19196b03a57344881b9df243a77cc8471d136149ac53f5eafca6",
            "tlsh":  "1282c89ad9986ce3c74b846a88d78551b33a790b340528387eac539c1f8cd7dd3b729c"
        },
        {
            "path":  "SPO365_GRAPH/SPO365_GRAPH.py",
            "sha256":  "1880d732fd191f07399729990017f332ad311ad2e7227933b84742fcc3c54547",
            "tlsh":  "f351204bd5521dd3e25ace33b3a6ec403615965f4443352c7deca0cc1f1182d9aeaac6"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "spo365_graph-1.1.2.tar.gz",
            "hashes":  {
                "blake2b_256":  "b6b83ff1e471cf3911711d530fa6eced94c554b4515fb72a311a971eb1f84773",
                "md5":  "967a63273068104ac04af88367fa74b4",
                "sha256":  "7acebd82867d0cbd20b951a1e4dd383935116b99c29959853fdded797cd5042d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spo365-graph/MAL-2026-17421.json"