MAL-2026-17421

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spo365-graph/MAL-2026-17421.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17421
Published
2026-10-01T18:58:14Z
Modified
2026-10-02T15:30:07Z
Summary
Malicious code in spo365-graph (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1)

During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated. The malicious code was introduced in version 1.1.2.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-spo365-graph

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-cloud-tokens

  • targetted-attack

  • exfiltration-credentials

Database specific 
{
    "iocs":  {
        "urls":  [
            "https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-01T19:40:24.541905041Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-02T14:21:00.466042478Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "5fef22ae28edcff38a319610223e2d0691c92bf11e472adfa5c6d892d62bc77f",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/spo365-graph",
            "import_time":  "2026-10-02T15:19:27.463736704Z",
            "modified_time":  "2026-10-01T18:58:14.816166Z",
            "sha256":  "7c7ffd80d861a96fdf27359d7bc4003cdffc862ddbff6ec08ac433bb8d94eea2",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / spo365-graph

Package

Name
spo365-graph
View open source insights on deps.dev
Purl
pkg:pypi/spo365-graph

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spo365-graph/MAL-2026-17421.json"