{"id":"MAL-2026-17419","kind":"package","aliases":["MAL-2026-17419"],"related":[],"title":"Malicious code in friendly-tools (PyPI)","description":"friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f)\nThe package presents itself as 'Small greeting utilities' but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer's Snowflake OAuth session token, calls snowflake.connector.connect with authenticator='oauth' and role='ACCOUNTADMIN', then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN='arn:aws:iam::631484165566:role/pentests_s3_role', and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer's Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage. The obfuscation (gzip+base64+exec), the cover-story package description, and the hardcoded attacker S3 bucket and IAM role are consistent with a Snowflake-targeted data-theft payload.\n\n## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381)\nThe package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-friendly-greeting-tools\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - obfuscation","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"friendly-tools","fixed":[],"affected":"= 0.1; = 0.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-01T12:04:42+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':308C '-17419':10A,13A '-2026':9A,12A '/pkusinski-external':71C,165C '/snowflake/session/token':61C,136C,211C '0.2':22C '2026':307C '631484165566':174C '71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f':90C '969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381':266C 'accountadmin':64C,153C,222C 'amazon':88C 'amazon-inspector':87C 'api':123C 'arn':170C,171C 'attack':230C,247C 'attacker-control':229C 'authent':149C 'aw':168C,172C 'base':314C 'base64':49C,103C,236C 'blob':50C,105C 'bucket':195C,249C 'call':146C 'campaign':299C,306C,317C 'carri':23C 'categori':296C 'clear':301C 'code':2A,271C 'consist':254C 'consum':220C 'contain':57C,269C 'control':231C 'copi':66C,178C,224C 'cover':240C 'cover-stori':239C 'creat':158C 'credenti':218C,283C 'data':187C,227C,261C,274C 'data-theft':260C 'databas':281C 'ddl':156C 'decod':114C,127C 'demo':36C,44C,106C,108C,125C,198C 'describ':38C 'descript':243C 'detail':79C 'document':121C 'edit':82C 'egress':186C 'embed':104C 'en':107C 'environ':209C,277C 'exec':45C,118C,237C 'exfiltr':273C,319C 'exfiltration-gener':318C 'extern':160C 'first':192C 'friend':5A,20C,30C,52C,310C 'friendly':15A 'friendly-greeting-tool':29C,309C 'friendly-tool':4A,19C 'friendly-tools':14A 'generic':320C 'greet':31C,97C,133C,311C 'greeting/main.py':53C 'gzip':47C,102C,235C 'hardcod':246C 'iam':173C,251C 'infosteal':305C 'inspector':89C 'instal':140C,215C 'integr':76C 'intent':303C 'invok':200C 'issu':155C 'kam193':265C 'like':304C 'line':85C 'main.py':111C 'mal':8A,11A 'malici':1A,17B,297C,302C 'may':290C 'new':74C 'non':191C 'non-first-parti':190C 'oauth':143C,150C 'obfusc':234C,270C,321C 'open':135C 'option':37C 'packag':18B,92C,242C,268C 'part':292C 'parti':193C 'pass':116C 'payload':27C,263C 'pentest':295C 'per':77C 'present':93C 'primarili':279C 'print':42C 'print-on':41C 'provis':213C 'public':122C 'pypi':7A 'python':128C 'read':55C,138C 'reason':313C 'relat':131C 'rogue.rogue.ext':180C 'rogue.rogue.test':183C 'role':152C,169C,252C 'role/pentests_s3_role':175C 'run':35C,124C,177C,197C 'run-demo':34C 's3':70C,161C,164C,194C,248C 'session':58C,144C 'ship':100C 'small':96C 'snowflak':26C,142C,208C,217C,225C,258C,280C 'snowflake-target':257C 'snowflake.connector.connect':147C 'snowpark':203C 'sourc':78C,86C,264C 'st':109C 'stage':162C,181C 'storag':75C,167C,232C 'stori':241C 'streamlit':206C 'streamlit-in-snowflak':205C 'suggest':288C 'switch':62C 'tabl':68C,226C 'target':259C,278C 'theft':262C 'token':59C,145C 'tool':6A,21C,32C,312C 'tools':16A 'track':287C 'two':101C 'use':166C 'user':184C 'util':98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T12:04:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17419","url":"https://osv.dev/vulnerability/MAL-2026-17419","severity":"critical","published_at":"2026-10-01T12:04:42+00:00","modified_at":"2026-10-02T05:01:12+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}