{"id":"MAL-2026-17319","kind":"package","aliases":["MAL-2026-17319"],"related":[],"title":"Malicious code in bfox-build-utils (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293)\nAt install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads `$GITHUB_WORKSPACE/.git/config`, regexes the `extraheader = AUTHORIZATION: basic <b64>` line that actions/checkout injects for the running job, base64-decodes it to recover the token, and also reads `GITHUB_TOKEN` from the environment. Using that token as `x-access-token`, it clones the installer's repository, creates branch `feature/ci-health-check`, writes `.github/workflows/ci-health-check.yml`, commits as `github-actions[bot]` with message `Add CI health check`, and pushes via git (with a REST-API fallback), explicitly bypassing the API restriction that protects workflow files. This plants a persistent, attacker-controlled GitHub Actions workflow in the installer's repository that will execute on future pushes to the planted branch. The shipped Python module `bfox_build_utils.py` is a two-line stub containing only `VERSION = \"1.0.997\"`; the package's advertised purpose (`Build utilities.`) and the innocuous naming of the branch, commit, and bot identity are cover for the credential theft and workflow-injection payload in setup.py.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bfox-build-utils","fixed":[],"affected":"= 1.0.997","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-30T03:04:36+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17319':11A,14A '-2026':10A,13A '1.0.997':178C 'access':95C 'action':112C,147C 'actions/checkout':67C 'add':116C 'advertis':182C 'also':82C 'amazon':32C 'amazon-inspector':31C 'api':128C,133C 'attack':144C 'attacker-control':143C 'author':63C 'base64':74C 'base64-decodes':73C 'basic':64C 'bfox':5A,16A 'bfox-build-util':4A 'bfox-build-utils':15A 'bfox_build_utils.py':168C 'bot':113C,195C 'branch':104C,163C,192C 'build':6A,17A,184C 'bypass':131C 'cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293':34C 'check':119C 'ci':117C 'clone':98C 'code':2A 'commit':108C,193C 'contain':175C 'control':145C 'cover':198C 'creat':103C 'credenti':44C,201C 'decod':75C 'detail':23C 'edit':26C 'environ':88C 'execut':156C 'explicit':130C 'extrahead':62C 'fallback':129C 'feature/ci-health-check':105C 'file':138C 'futur':158C 'git':123C 'github':43C,58C,84C,111C,146C 'github-act':110C 'github/workflows/ci-health-check.yml':107C 'harvest':39C 'health':118C 'ident':196C 'inject':68C,206C 'innocu':188C 'inspector':33C 'instal':36C,41C,51C,100C,151C 'job':72C 'line':29C,65C,173C 'mal':9A,12A 'malici':1A,19B 'messag':115C 'modifi':49C 'modul':167C 'name':189C 'packag':20B,180C 'payload':207C 'per':21C 'persist':142C 'plant':140C,162C 'protect':136C 'purpos':183C 'push':121C,159C 'pypi':8A 'python':166C 'read':57C,83C 'recov':78C 'regex':60C 'repositori':54C,102C,153C 'rest':127C 'rest-api':126C 'restrict':134C 'run':71C 'script':56C 'setup.py':38C,209C 'ship':165C 'sourc':22C,30C 'stub':174C 'theft':202C 'time':37C 'token':80C,85C,91C,96C 'two':172C 'two-lin':171C 'use':46C,89C 'util':7A,185C 'utils':18A 'version':177C 'via':122C 'workflow':137C,148C,205C 'workflow-inject':204C 'workspace/.git/config':59C 'write':106C 'x':94C 'x-access-token':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T03:04:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17319","url":"https://osv.dev/vulnerability/MAL-2026-17319","severity":"critical","published_at":"2026-09-30T03:04:36+00:00","modified_at":"2026-09-30T03:30:05+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}