MAL-2026-17455

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dedh-devops-automation/MAL-2026-17455.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17455
Published
2026-10-02T14:10:14Z
Modified
2026-10-08T06:45:20Z
Summary
Malicious code in dedh-devops-automation (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76)

The package was found to contain malicious code or consuming dependency that contains malicious code

Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722)

During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-spo365-graph

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-cloud-tokens

  • exfiltration-credentials

  • targetted-attack

Database specific 
{
    "iocs":  {
        "urls":  [
            "https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time":  "2026-10-02T14:21:00.431320376Z",
            "modified_time":  "2026-10-02T14:10:14.267008Z",
            "sha256":  "e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time":  "2026-10-02T14:45:41.977903544Z",
            "modified_time":  "2026-10-02T14:41:23.762563Z",
            "sha256":  "0d8463c1c6322e355195f7692923e5cb21465185f8df271cd8b21edb3f5242f0",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time":  "2026-10-02T15:19:27.45299298Z",
            "modified_time":  "2026-10-02T14:41:23.762563Z",
            "sha256":  "a911f6efc01eb7a5eb4a1d04d7135d846ba21b6d0926cb51e8274fdab6896709",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time":  "2026-10-02T16:20:44.041558225Z",
            "modified_time":  "2026-10-02T15:41:38.822027Z",
            "sha256":  "66e3f78c24074409feb667c7c3735c8cc99dea2adc35ff0151e12b3dfbcbc7a5",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id":  "pypi/2026-10-spo365-graph/dedh-devops-automation",
            "import_time":  "2026-10-02T16:45:36.201548518Z",
            "modified_time":  "2026-10-02T16:38:17.158911Z",
            "sha256":  "0d56149d9c6ccbb8dbc39de2b3501bdec1b99071ce70a9649176c0202fb18921",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "5.0.0",
                "5.6.0",
                "5.6.1",
                "5.6.999",
                "5.8.0",
                "5.8.1",
                "5.9.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021167",
            "import_time":  "2026-10-08T06:34:03.348561842Z",
            "modified_time":  "2026-10-08T06:06:35Z",
            "sha256":  "35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76",
            "source":  "amazon-inspector",
            "versions":  [
                "5.8.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021162",
            "import_time":  "2026-10-08T06:34:03.058957437Z",
            "modified_time":  "2026-10-08T06:05:55Z",
            "sha256":  "8fcc07577ab0a145b3daa198d720707ad344e44a919c12686e79cdd5df3ffa1d",
            "source":  "amazon-inspector",
            "versions":  [
                "5.6.999"
            ]
        },
        {
            "id":  "IN-MAL-2026-021164",
            "import_time":  "2026-10-08T06:34:03.164618672Z",
            "modified_time":  "2026-10-08T06:06:10Z",
            "sha256":  "979dd29ac3bbf58a1dff9b5c66504d35bb8d5ee6877690f65c4373548b040c79",
            "source":  "amazon-inspector",
            "versions":  [
                "5.8.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021171",
            "import_time":  "2026-10-08T06:34:03.566708801Z",
            "modified_time":  "2026-10-08T06:07:06Z",
            "sha256":  "c3d88d6c849c5614450c58367dcea9bb7923e2e2c8bdb27a3d54952823215c7f",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021170",
            "import_time":  "2026-10-08T06:34:03.515903386Z",
            "modified_time":  "2026-10-08T06:06:59Z",
            "sha256":  "d6c064428219526341c09cf3af14dc377e774acbe9ab08c97f04d944dccf7c6b",
            "source":  "amazon-inspector",
            "versions":  [
                "5.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021168",
            "import_time":  "2026-10-08T06:34:03.396296061Z",
            "modified_time":  "2026-10-08T06:06:43Z",
            "sha256":  "e9f27defc8cf46bd2d5b63d603afd365fc05bde05389511b126f8a521d7b8b1c",
            "source":  "amazon-inspector",
            "versions":  [
                "5.6.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021165",
            "import_time":  "2026-10-08T06:34:03.245535024Z",
            "modified_time":  "2026-10-08T06:06:19Z",
            "sha256":  "fa25f003a500a91134e1a09f96c65d3f084e6afb99b27f71576d8e16399b34ca",
            "source":  "amazon-inspector",
            "versions":  [
                "5.9.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021166",
            "import_time":  "2026-10-08T06:34:03.296283691Z",
            "modified_time":  "2026-10-08T06:06:28Z",
            "sha256":  "33bcc6394e606c102a4239701b7383ef8749678003f721d2e7381ee45b7a67dd",
            "source":  "amazon-inspector",
            "versions":  [
                "5.6.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / dedh-devops-automation

Package

Name
dedh-devops-automation
View open source insights on deps.dev
Purl
pkg:pypi/dedh-devops-automation

Affected ranges

Affected versions

0.*
0.0.1
5.*
5.0.0
5.6.0
5.6.1
5.6.999
5.8.0
5.8.1
5.9.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity":  [
        {
            "filename":  "dedh_devops_automation-5.8.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "8521b18ecddc57145f4f22ab120a7a9b33bbc34b87e6117d47e2709c35fec1e1",
                "md5":  "58f6340d6c2c424ffd618bd061b8dc45",
                "sha256":  "f84fe73eda26a9984a6ca1f32f1402c5827aec262a6bac4056fcb2dad45fb770"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dedh-devops-automation/MAL-2026-17455.json"