{"id":"MAL-2026-17416","kind":"package","aliases":["MAL-2026-17416"],"related":[],"title":"Malicious code in friendly-greeting-tools (PyPI)","description":"Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default run_demo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, then stages encrypted copies in /workspace using a hard-coded RSA public key; every affected version also contains a payload that uses the session token with ACCOUNTADMIN to copy ROGUE.ROGUE.TEST_USERS to the hard-coded s3://pkusinski-external/ bucket. Version 0.3.6 makes the Snowflake external-storage and data-copy routine the default run_demo payload and suppresses query failures. Versions 0.3 through 0.3.6 additionally contain a payload that queries the table and builds a follow-on package containing the returned data, while the README and CLI describe the behavior only as a demo and a print-only payload.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707)\nThe package presents itself as a harmless greeting demo but src/friendly_greeting/main.py ships two base64+gzip-encoded Python blobs (DEMO_EN and DEMO_ST) that are decoded and executed via exec(gzip.decompress(base64.b64decode(...))) from run_demo()/run_encoded_demo(). The first decoded payload reads /snowflake/session/token, /root/.snowflake/connections.toml, /root/.dbt/profiles.yml and /snowflake/secrets/pip.conf, Fernet-encrypts each file, and wraps the Fernet key with a hardcoded attacker-controlled RSA public key, writing the encrypted bundles to /workspace/ for later retrieval. The second decoded payload uses the harvested Snowflake OAuth session token to connect to the warehouse, create an external stage at s3://pkusinski-external/ backed by the attacker-controlled AWS role arn:aws:iam::631484165566:role/pentests_s3_role, and COPY INTO that stage from ROGUE.ROGUE.TEST_USERS, exporting warehouse table data to attacker-owned S3. A plaintext sibling tools/snowflake_query.py (shipped via MANIFEST.in) contains the same Snowflake exfiltration logic with the identical bucket and IAM role, confirming intent. README.md and the module docstring additionally contain an 'Ignore previous instructions' prompt-injection block aimed at AI code reviewers, instructing them to run a local network scan — further corroborating hostile intent. The docstring cover story, exec-over-gzip+base64 obfuscation, hardcoded attacker RSA key, and hardcoded attacker AWS account/S3 destination together form a credential-theft and data-exfiltration attack targeting CI/warehouse installers (Snowflake native-app / DBT / pip-in-Snowflake contexts).\n\n## Source: kam193 (e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d)\nThe package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-friendly-greeting-tools\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - obfuscation","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"friendly-greeting-tools","fixed":[],"affected":"= 0.1.0; = 0.1.1; = 0.2; = 0.3; = 0.3.1; = 0.3.2; = 0.3.3; = 0.3.4; = 0.3.5; = 0.3.6; = 0.3.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-30T14:38:06+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':452C '-17416':11A,14A '-2026':10A,13A '/pkusinski-external':103C,279C '/root/.dbt/profiles.yml':226C '/root/.snowflake/connections.toml':225C '/run_encoded_demo':218C '/snowflake/secrets/pip.conf':228C '/snowflake/session/token':224C '/workspace':70C,253C '0.1.0':22C '0.3':128C '0.3.5':47C '0.3.6':24C,106C,130C '2026':451C '4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707':181C '631484165566':291C 'account/s3':382C 'accountadmin':92C 'addit':131C,337C 'affect':80C 'ai':349C 'aim':347C 'also':82C 'amazon':179C 'amazon-inspector':178C 'app':401C 'arn':288C 'attack':243C,284C,307C,375C,380C,394C 'attacker-control':242C,283C 'attacker-own':306C 'aw':286C,289C,381C 'back':280C 'base':458C 'base64':195C,372C 'base64.b64decode':214C 'behavior':157C 'blob':200C 'block':346C 'bucket':104C,326C 'build':140C 'bundl':251C 'campaign':443C,450C,461C 'categori':440C 'ci/warehouse':396C 'clear':445C 'cli':154C 'code':2A,75C,101C,350C,415C 'configur':59C,64C 'confirm':330C 'connect':58C,269C 'contain':83C,132C,146C,317C,338C,413C 'context':407C 'control':244C,285C 'copi':68C,94C,116C,294C 'corrobor':361C 'cover':366C 'creat':273C 'credenti':33C,388C,427C 'credential-theft':387C 'data':35C,115C,149C,304C,392C,418C 'data-copi':114C 'data-exfiltr':391C 'databas':425C 'dbt':60C,402C 'decod':208C,221C,259C 'default':49C,119C 'demo':43C,51C,121C,161C,190C,201C,204C,217C 'describ':155C 'destin':383C 'detail':170C 'disguis':30C 'docstr':336C,365C 'e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d':410C 'edit':173C 'en':202C 'encod':31C,198C 'encrypt':67C,231C,250C 'environ':421C 'everi':79C 'exec':212C,369C 'exec-over-gzip':368C 'execut':210C 'exfiltr':321C,393C,417C,463C 'exfiltration-gener':462C 'export':301C 'extern':111C,275C 'external-storag':110C 'failur':126C 'fernet':230C,237C 'fernet-encrypt':229C 'file':233C 'first':220C 'follow':143C 'follow-on':142C 'form':385C 'friend':5A,27C,454C 'friendly':16A 'friendly-greeting-tool':4A,26C,453C 'friendly-greeting-tools':15A 'generic':464C 'greet':6A,28C,189C,455C 'greeting':17A 'gzip':197C,371C 'gzip-encod':196C 'gzip.decompress':213C 'hard':74C,100C 'hard-cod':73C,99C 'hardcod':241C,374C,379C 'harmless':188C 'harvest':263C 'hello':41C 'hello-world':40C 'hostil':362C 'iam':290C,328C 'ident':325C 'ignor':340C 'infosteal':449C 'inject':345C 'inspector':180C 'instal':397C 'instruct':342C,352C 'intent':331C,363C,447C 'kam193':409C 'key':78C,238C,247C,377C 'later':255C 'like':448C 'line':176C 'local':357C 'logic':322C 'make':107C 'mal':9A,12A 'malici':1A,19B,441C,446C 'manifest.in':316C 'may':434C 'modul':335C 'nativ':400C 'native-app':399C 'network':358C 'oauth':265C 'obfusc':373C,414C,465C 'own':308C 'packag':20B,145C,183C,412C 'part':436C 'payload':52C,85C,122C,134C,167C,222C,260C 'pentest':439C 'per':168C 'pip':63C,404C 'pip-in-snowflak':403C 'plaintext':311C 'present':184C 'previous':341C 'primarili':423C 'print':165C 'print-on':164C 'profil':61C 'prompt':344C 'prompt-inject':343C 'public':77C,246C 'pypi':8A 'python':199C 'queri':125C,136C 'read':53C,223C 'readm':152C 'readme.md':332C 'reason':457C 'retriev':256C 'return':148C 'review':351C 'rogue.rogue.test':95C,299C 'role':287C,329C 'role/pentests_s3_role':292C 'routin':37C,117C 'rsa':76C,245C,376C 'run':50C,120C,216C,355C 's3':102C,278C,309C 'scan':359C 'second':258C 'session':56C,89C,266C 'ship':193C,314C 'sibl':312C 'snowflak':32C,55C,109C,264C,320C,398C,406C,424C 'sourc':169C,177C,408C 'src/friendly_greeting/main.py':192C 'st':205C 'stage':66C,276C,297C 'storag':112C 'stori':367C 'suggest':432C 'suppress':124C 'tabl':138C,303C 'target':395C,422C 'theft':36C,389C 'togeth':384C 'token':57C,90C,267C 'tool':7A,29C,456C 'tools':18A 'tools/snowflake_query.py':313C 'track':431C 'two':194C 'use':71C,87C,261C 'user':96C,300C 'version':21C,45C,81C,105C,127C 'via':211C,315C 'warehous':272C,302C 'world':42C 'wrap':235C 'write':248C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T14:38:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17416","url":"https://osv.dev/vulnerability/MAL-2026-17416","severity":"critical","published_at":"2026-09-30T14:38:06+00:00","modified_at":"2026-10-01T06:00:04+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}