MAL-2026-18402: Malicious code in test-01-rafamarrara-learning-dc (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612) Package appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or secret reads, no subprocess execution of fetched content, and no lifecycle hooks that would harm the installer.
Source: kam193 (c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816) Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-test-01-rafamarrara-learning-dc
Reasons (based on the campaign):
- backdoor
- exfiltration-env-variables
Affected Software
Frequently Asked Questions
What access would an attacker need to exploit the package's hidden functionality?
The package is described as web-application middleware with a diagnostic endpoint. An attacker would need to be able to send commands to that endpoint in a deployed application using the middleware.
What data could be exposed if the package is deployed?
The reported functionality can exfiltrate environment variables. Environment variables may contain application configuration or secrets, depending on how the affected application is configured.
What should teams do if they cannot immediately remove the package?
The provided data identifies a hidden command-execution capability and environment-variable exfiltration but does not document a mitigation or safe configuration. Treat systems using it as potentially exposed, restrict access to the diagnostic endpoint, and avoid storing sensitive values in environment variables where possible.
How can I determine whether an application may be affected?
Check whether the project's Python dependencies include test-01-rafamarrara-learning-dc, including transitive or development dependencies, and whether its middleware has been enabled in a web application. The referenced PyPI release is version 1.0.0.