MAL-2026-4776

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/whatsfly-labfox/MAL-2026-4776.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4776
Published
2026-05-24T16:52:10Z
Modified
2026-06-15T03:00:55Z
Summary
Malicious code in whatsfly-labfox (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f)

On import whatsfly, whatsfly/__init__.py invokes ensureUsableBinaries() from whatsfly/dependencies/builder.py, which downloads a native binary (.so/.dll/.dylib) from the GitHub Actions artifacts API for Labfox/whatsfly, unzips it under whatsfly/dependencies/whatsmeow/, and whatsmeow.py loads it directly via ctypes.CDLL(...). The download is authenticated with a fine-grained GitHub Personal Access Token (github_pat_11AZ7BYQI05SxpWYyU3Ctr_e2PlN...) reconstructed at runtime from a per-character list in whatsfly/dependencies/github_actions_download.py:7 — a deliberate obfuscation pattern used to evade GitHub's automated secret scanning. Two installer-impacting consequences follow: (1) every installer extracts the same live GitHub PAT and can use it against the author's GitHub account and the Labfox/whatsfly repository (credential redistribution to third parties); (2) the fetched artifact is a GitHub Actions artifact (mutable, 90-day TTL) pinned only by the loose string version="v20" with no hash or signature verification — anyone holding the PAT (including any installer of this package) can replace the artifact and achieve remote code execution on every subsequent importer via the ctypes load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004517",
            "import_time": "2026-05-26T05:52:45.573627433Z",
            "modified_time": "2026-05-24T16:52:15Z",
            "sha256": "44d4a24d293f810bd11587936b79a835fb0671b7af961328f836d57c7b0c4514",
            "source": "amazon-inspector",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004515",
            "import_time": "2026-05-26T05:52:45.372852238Z",
            "modified_time": "2026-05-24T16:52:10Z",
            "sha256": "68fe57da48ce63ec7cec5176168ccdfbe05e8b6f83a83c39a0440289141ee2d1",
            "source": "amazon-inspector",
            "versions": [
                "0.2.1"
            ]
        },
        {
            "id": "IN-MAL-2026-004516",
            "import_time": "2026-05-26T05:52:45.467178562Z",
            "modified_time": "2026-05-24T16:52:15Z",
            "sha256": "c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f",
            "source": "amazon-inspector",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004518",
            "import_time": "2026-05-26T05:52:45.724484249Z",
            "modified_time": "2026-05-24T16:52:19Z",
            "sha256": "f6aa24abde03297259d087a25b56eaa29010b3d2857599bbe9fbe0b60af92959",
            "source": "amazon-inspector",
            "versions": [
                "0.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / whatsfly-labfox

Package

Name
whatsfly-labfox
View open source insights on deps.dev
Purl
pkg:pypi/whatsfly-labfox

Affected ranges

Affected versions

0.*
0.2.0
0.2.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "api.github.com"
    ],
    "evidence_files": [
        {
            "path": "whatsfly/dependencies/github_actions_download.py",
            "sha256": "f88963d32091922133fe8f29fea794225ba9328cf89f4e9528606dc64daac2a2",
            "tlsh": "28214245861d74328b522f9849e58c273768e557e100b1b6bebc43fd6fc849c43e76c9"
        }
    ],
    "package_integrity": [
        {
            "filename": "whatsfly_labfox-0.2.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "60d2bd37c3c8f783b75ea5a429ef9099b97bb95a542cfa47649a3282c7df669e",
                "md5": "501131cc673fd42799b0e8c764076e65",
                "sha256": "52c4e400727c69f583c2202cebbaa6e366e24af5f235062ad3cba01f1fbb9b9e"
            }
        },
        {
            "filename": "whatsfly_labfox-0.2.1.tar.gz",
            "hashes": {
                "blake2b_256": "620feca1907290d22e6e2b9f5c6cef0a2db34ef3355e25b31c84ecf3aac78a9e",
                "md5": "8beb276fb18b3c2a1ac67026940fd4fe",
                "sha256": "7a60d1c1f060b6aa6026f515cd3bd553235731c39272aaa894e3b10854c216c2"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/whatsfly-labfox/MAL-2026-4776.json"