{"id":"MAL-2026-17455","kind":"package","aliases":["MAL-2026-17455"],"related":[],"title":"Malicious code in dedh-devops-automation (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722)\nDuring installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-spo365-graph\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-credentials\n\n\n - targetted-attack","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dedh-devops-automation","fixed":[],"affected":"= 0.0.1; = 5.0.0; = 5.6.0; = 5.6.1; = 5.6.999; = 5.8.0; = 5.8.1; = 5.9.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-02T14:10:14+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':92C '-17455':11A,14A '-2026':10A,13A '2026':91C '35e844':34C 'ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76':35C 'amazon':32C 'amazon-inspector':31C 'attack':124C 'autom':7A 'automation':18A 'aw':61C 'base':97C 'campaign':83C,90C,100C 'categori':80C 'clear':85C 'cloud':117C 'code':2A,43C,50C,112C 'collect':65C,73C 'command':106C 'consum':45C 'contain':41C,48C 'credenti':66C,121C 'data':75C,76C 'dedh':5A,16A 'dedh-devops-autom':4A 'dedh-devops-automation':15A 'depend':46C 'deploy':58C 'detail':23C 'devop':6A 'devops':17A 'e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722':53C 'edit':26C 'execut':110C 'exfiltr':79C,116C,120C 'exfiltration-cloud-token':115C 'exfiltration-credenti':119C 'found':39C 'function':63C 'graph':95C 'infosteal':89C 'inspector':33C 'instal':55C,105C,114C 'intent':87C 'kam193':52C 'lambda':62C 'like':88C 'line':29C 'mal':9A,12A 'malici':1A,19B,42C,49C,81C,86C,111C 'manag':69C 'overrid':103C 'packag':20B,37C,57C,102C 'per':21C 'pypi':8A 'reason':96C 'rogu':60C 'secret':68C 'setup.py':108C 'sourc':22C,30C,51C 'spo365':94C 'spo365-graph':93C 'target':123C 'targetted-attack':122C 'token':118C 'well':71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-02T14:10:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17455","url":"https://osv.dev/vulnerability/MAL-2026-17455","severity":"critical","published_at":"2026-10-02T14:10:14+00:00","modified_at":"2026-10-08T06:45:20+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}