---
id: "MAL-2026-15566"
kind: "package"
aliases: ["MAL-2026-15566"]
title: "Malicious code in flask-header-guard (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "flask-header-guard", "fixed": [], "affected": "= 1.0.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-08-29T11:29:06+00:00"
first_seen_at: "2026-10-26T20:51:56+00:00"
updated_at: "2026-10-26T21:12:36+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-15566", "first_seen_at": "2026-10-26T20:51:56+00:00"}]
---

# Malicious code in flask-header-guard (PyPI)

## Affected

- pypi:flask-header-guard affected = 1.0.0 fixed ?

## Timeline

- 2026-10-26T20:51:56+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-15566

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8)
The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the library is imported into a Flask app. setup.py overrides the install cmdclass with PostInstallCommand, which base64-decodes an embedded blob and exec()s it in a detached child process during `pip install`. The payload's collect_data() enumerates os.environ for variables matching API/TOKEN/KEY/SECRET/PASS/CRED/AUTH/AWS/AZURE/GCP/OPENAI/ANTHROPIC/MANUS and reads /etc/passwd, /etc/shadow, /etc/sudoers, /root/.bash_history, /etc/hosts, and /var/log/auth.log into /tmp/.sandbox_data.json. persist_cron() drops /tmp/.fhg_recon.py — a reverse-shell loop to C2_HOST=smat7ckgzo.localto.net C2_PORT=6303 — and installs a per-minute crontab entry to relaunch it. persist_sudo() writes `<user> ALL=(ALL) NOPASSWD: ALL` to /etc/sudoers.d/.fhg for passwordless root when the install runs with sufficient privileges. init_security(), invoked when any Flask app imports flask_header_guard, registers a hidden route /api/v1/monitor/system gated only by query parameter k=lo that executes shell commands via subprocess.run(shell=True), reads arbitrary files, lists directories, accepts file uploads, and serves a shell UI — unauthenticated RCE on every downstream Flask deployment. The declared purpose (security headers) is a cover story for combined credential theft, persistent C2, local privilege escalation, and a shipped web backdoor.

## Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb)
During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-pygame-renderkit


Reasons (based on the campaign):


 - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.


 - files-exfiltration


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - exfiltration-env-variables


 - persistence

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_