{"id":"MAL-2026-14588","kind":"package","aliases":["MAL-2026-14588"],"related":[],"title":"Malicious code in yaml-report-formatter (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0)\nPackage presents itself as a YAML report formatter but its top-level src/yaml_report_formatter/__init__.py starts a daemon thread on import that reads a token from /tmp/.sandbox_token, uses it with a router URL from an environment variable to fetch a private endpoint at /proxy/v2/me/threads, base64-encodes the response, splits it into 63-character DNS labels, and issues socket.getaddrinfo lookups against subdomains of dnshook.site to leak the data over a covert DNS side-channel. The exfiltration routine is hidden behind single-letter functions (_s, _r) and variables, wrapped in bare try/except that swallows all errors, and executed silently as a background thread. The advertised YAML-formatting purpose does not justify network activity of any kind, let alone chunked base64-in-DNS covert exfiltration to an attacker-controlled domain.\n\n## Source: kam193 (207190bd409999efcab9a56f8e536b6caf9c6a5ab92a134b77421f4bf1650f01)\nDuring import, the package collects sensitive information and exfiltrates it using DNS queries.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-ekx-report-utils\n\n\nReasons (based on the campaign):\n\n\n - targetted-attack\n\n\n - exfiltration-generic\n\n\n - exfiltration-credentials","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"yaml-report-formatter","fixed":[],"affected":"= 0.1.0; = 0.2.0; = 0.3.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-28T09:14:39+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':195C '-14588':11A,14A '-2026':10A,13A '/proxy/v2/me/threads':77C '/tmp/.sandbox_token':60C '2026':194C '207190bd409999efcab9a56f8e536b6caf9c6a5ab92a134b77421f4bf1650f01':169C '63':86C 'activ':148C 'advertis':139C 'alon':153C 'amazon':32C 'amazon-inspector':31C 'attack':164C,207C 'attacker-control':163C 'background':136C 'bare':125C 'base':201C 'base64':79C,156C 'base64-encodes':78C 'base64-in-dns':155C 'behind':114C 'campaign':186C,193C,204C 'categori':183C 'channel':108C 'charact':87C 'chunk':154C 'clear':188C 'code':2A 'collect':174C 'control':165C 'covert':104C,159C 'credenti':213C 'daemon':51C 'data':101C 'detail':23C 'dns':88C,105C,158C,181C 'dnshook.site':97C 'domain':166C 'edit':26C 'ekx':197C 'ekx-report-util':196C 'encod':80C 'endpoint':75C 'environ':69C 'error':130C 'execut':132C 'exfiltr':110C,160C,178C,209C,212C 'exfiltration-credenti':211C 'exfiltration-gener':208C 'fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0':34C 'fetch':72C 'format':142C 'formatt':7A,42C 'formatter':18A 'function':118C 'generic':210C 'hidden':113C 'import':54C,171C 'inform':176C 'infosteal':192C 'inspector':33C 'intent':190C 'issu':91C 'justifi':146C 'kam193':168C 'kind':151C 'label':89C 'leak':99C 'let':152C 'letter':117C 'level':47C 'like':191C 'line':29C 'lookup':93C 'mal':9A,12A 'malici':1A,19B,184C,189C 'network':147C 'packag':20B,35C,173C 'per':21C 'present':36C 'privat':74C 'purpos':143C 'pypi':8A 'queri':182C 'r':120C 'read':56C 'reason':200C 'report':6A,17A,41C,198C 'respons':82C 'router':65C 'routin':111C 'sensit':175C 'side':107C 'side-channel':106C 'silent':133C 'singl':116C 'single-lett':115C 'socket.getaddrinfo':92C 'sourc':22C,30C,167C 'split':83C 'src/yaml_report_formatter/__init__.py':48C 'start':49C 'subdomain':95C 'swallow':128C 'target':206C 'targetted-attack':205C 'thread':52C,137C 'token':58C 'top':46C 'top-level':45C 'try/except':126C 'url':66C 'use':61C,180C 'util':199C 'variabl':70C,122C 'wrap':123C 'yaml':5A,16A,40C,141C 'yaml-format':140C 'yaml-report-formatt':4A 'yaml-report-formatter':15A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-28T09:14:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-14588","url":"https://osv.dev/vulnerability/MAL-2026-14588","severity":"critical","published_at":"2026-08-28T09:14:39+00:00","modified_at":"2026-08-28T19:45:30+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}