{"id":"MAL-2024-12279","kind":"package","aliases":["MAL-2024-12279"],"related":[],"title":"Malicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (73ea760146181d2911e0823c121502506892b2e63d3fc20d6281fb2c86e03de8)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google-cloud-datacatalog-lineage-producer-client","fixed":[],"affected":"= 9999; = 99999999","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2024-07-26T16:53:30+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:14:45+00:00","updated_at":"2026-10-26T21:14:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-12279':14A,17A '-2024':13A,16A '73ea760146181d2911e0823c121502506892b2e63d3fc20d6281fb2c86e03de8':38C 'also':69C 'anyth':70C 'base':96C 'basic':47C,106C 'campaign':88C,99C 'categori':59C 'clear':83C 'client':10A,24A 'cloud':6A,20A 'co':81C 'code':2A,103C,131C 'command':125C 'contain':102C 'data':107C 'datacatalog':7A,21A 'detail':29C 'edit':32C 'execut':129C 'exfiltr':46C,105C 'explor':75C 'generic':90C 'generic-standard-pypi-install-pentest':89C 'googl':5A 'google':19A 'google-cloud-datacatalog-lineage-producer-cli':4A 'google-cloud-datacatalog-lineage-producer-client':18A 'harm':86C 'host':51C 'import':43C 'inform':48C 'instal':39C,93C,124C,133C 'ip':112C 'kam193':37C 'kit':79C 'like':64C,73C,111C 'limit':118C 'line':35C 'lineag':8A 'lineage':22A 'look':63C,72C 'low':85C 'low-harm':84C 'mal':12A,15A 'malici':1A,25B,130C 'modul':45C 'overrid':122C 'packag':26B,41C,54C,62C,67C,101C,121C 'pentest':61C,66C,94C 'per':27C 'possibl':87C 'pre':77C 'pre-prepar':76C 'prepar':78C 'probabl':60C 'produc':9A 'producer':23A 'purpos':58C 'pypi':11A,92C 'reason':95C 'research':80C 'risk':119C 'setup.py':127C 'sourc':28C,36C 'standard':91C 'system':110C 'test':74C 'typic':65C 'usernam':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-07-26T16:53:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2024-12279","url":"https://osv.dev/vulnerability/MAL-2024-12279","severity":"critical","published_at":"2024-07-26T16:53:30+00:00","modified_at":"2026-09-21T04:45:04+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}