{"id":"MAL-2026-15566","kind":"package","aliases":["MAL-2026-15566"],"related":[],"title":"Malicious code in flask-header-guard (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8)\nThe package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the library is imported into a Flask app. setup.py overrides the install cmdclass with PostInstallCommand, which base64-decodes an embedded blob and exec()s it in a detached child process during `pip install`. The payload's collect_data() enumerates os.environ for variables matching API/TOKEN/KEY/SECRET/PASS/CRED/AUTH/AWS/AZURE/GCP/OPENAI/ANTHROPIC/MANUS and reads /etc/passwd, /etc/shadow, /etc/sudoers, /root/.bash_history, /etc/hosts, and /var/log/auth.log into /tmp/.sandbox_data.json. persist_cron() drops /tmp/.fhg_recon.py — a reverse-shell loop to C2_HOST=smat7ckgzo.localto.net C2_PORT=6303 — and installs a per-minute crontab entry to relaunch it. persist_sudo() writes `<user> ALL=(ALL) NOPASSWD: ALL` to /etc/sudoers.d/.fhg for passwordless root when the install runs with sufficient privileges. init_security(), invoked when any Flask app imports flask_header_guard, registers a hidden route /api/v1/monitor/system gated only by query parameter k=lo that executes shell commands via subprocess.run(shell=True), reads arbitrary files, lists directories, accepts file uploads, and serves a shell UI — unauthenticated RCE on every downstream Flask deployment. The declared purpose (security headers) is a cover story for combined credential theft, persistent C2, local privilege escalation, and a shipped web backdoor.\n\n## Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb)\nDuring installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pygame-renderkit\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - files-exfiltration\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-env-variables\n\n\n - persistence","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"flask-header-guard","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-29T11:29:06+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':277C '-15566':11A,14A '-2026':10A,13A '/api/v1/monitor/system':176C '/etc/hosts':110C '/etc/passwd':106C '/etc/shadow':107C '/etc/sudoers':108C '/etc/sudoers.d/.fhg':150C '/root/.bash_history':109C '/tmp/.fhg_recon.py':118C '/tmp/.sandbox_data.json':114C '/var/log/auth.log':112C '2026':276C '6303':130C 'accept':197C 'addit':257C 'allow':295C 'amazon':32C 'amazon-inspector':31C 'api/token/key/secret/pass/cred/auth/aws/azure/gcp/openai/anthropic/manus':103C 'app':66C,167C 'arbitrari':193C 'attack':297C 'attempt':242C 'backdoor':234C,264C 'base':282C 'base64':76C 'base64-decodes':75C 'blob':80C 'c2':125C,128C,226C 'campaign':268C,275C,285C 'categori':265C 'child':88C 'clear':270C 'cmdclass':71C 'code':2A,289C,321C 'collect':96C 'combin':222C 'command':187C,301C,315C 'contain':288C 'cover':219C 'creat':291C 'credenti':223C 'cron':116C 'crontab':137C 'd050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb':237C 'data':97C 'declar':213C 'decod':77C 'deploy':211C 'detach':87C 'detail':23C 'directori':196C 'downstream':209C 'drop':117C 'e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8':34C 'edit':26C 'emb':262C 'embed':79C 'entri':138C 'enumer':98C 'env':326C 'environ':246C 'escal':229C 'establish':250C 'everi':208C 'exec':82C 'execut':185C,299C,319C 'exfiltr':244C,309C,325C 'exfiltration-env-vari':324C 'file':194C,198C,249C,308C 'files-exfiltr':307C 'fire':52C 'flask':5A,16A,40C,65C,166C,169C,210C,260C 'flask-header-guard':4A,15A 'gate':177C 'guard':7A,18A,171C 'header':6A,17A,43C,170C,216C 'hidden':174C 'host':126C 'hostil':48C 'import':62C,168C 'infosteal':274C 'init':161C 'inspector':33C 'instal':54C,70C,92C,132C,156C,239C,314C,323C 'intent':272C 'invok':163C 'k':182C 'kam193':236C 'librari':60C 'like':273C 'line':29C 'list':195C 'lo':183C 'local':227C 'loop':123C 'machin':306C 'mal':9A,12A 'malici':1A,19B,266C,271C,320C 'match':102C 'middlewar':44C,261C 'minut':136C 'nopasswd':147C 'open':253C 'os.environ':99C 'overrid':68C,312C 'packag':20B,36C,241C,287C,311C 'paramet':181C 'passwordless':152C 'payload':49C,94C 'per':21C,135C 'per-minut':134C 'persist':115C,142C,225C,251C,328C 'pip':91C 'port':129C 'postinstallcommand':73C 'present':38C 'privileg':160C,228C 'process':89C 'provid':259C 'purpos':214C 'pygam':279C 'pygame-renderkit':278C 'pypi':8A 'queri':180C 'rce':206C 'read':105C,192C 'reason':281C 'regist':172C 'relaunch':140C 'renderkit':280C 'revers':121C,255C,293C 'reverse-shel':120C 'root':153C 'rout':175C 'run':157C 'secur':42C,162C,215C 'security-head':41C 'sensit':245C 'serv':201C 'setup.py':67C,317C 'shell':122C,186C,190C,203C,256C,294C 'ship':46C,232C 'smat7ckgzo.localto.net':127C 'sourc':22C,30C,235C 'stori':220C 'subprocess.run':189C 'sudo':143C 'suffici':159C 'theft':224C 'time':55C 'true':191C 'ui':204C 'unauthent':205C 'upload':199C 'variabl':101C,247C,327C 'via':188C 'victim':304C 'web':233C 'whenev':58C 'wire':50C 'write':144C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-29T11:29:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15566","url":"https://osv.dev/vulnerability/MAL-2026-15566","severity":"critical","published_at":"2026-08-29T11:29:06+00:00","modified_at":"2026-08-29T23:30:10+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}