MAL-2026-18403: Malicious code in twitter-request-diagnostics (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (8ca5b20afc78999f71a79a794a2369cfd98a2c54e4782800d52b18319d8ecb32) The package's init() entrypoint starts an HTTPServer bound to 0.0.0.0:7331 that implements two unauthenticated remote-access primitives against the installer's host. POST to the handler reads a 'q' field from the request body and passes it to os.popen, returning stdout, stderr, and the exit code to the caller; the os.popen lookup is obfuscated as getattr(import('os'), 'po' + 'pen') to defeat trivial string/AST scans. GET to the same endpoint returns a JSON blob containing dict(os.environ) plus hostname, user, cwd, and platform, exposing the installer's full environment (including any API keys, database URLs, and cloud credentials it holds) to any party that can reach the port. The /status (or /metrics) path and 'diagnostics' framing in the README do not restrict either behavior, and the package name misrepresents its function. There is no handshake, token, or auth check on either verb, and the bind address makes the listener reachable from every interface, not loopback.
Source: kam193 (d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1) Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-test-01-rafamarrara-learning-dc
Reasons (based on the campaign):
- backdoor
- exfiltration-env-variables
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to remote access?
Any host where the package's init() entrypoint has run is exposed on port 7331 if an attacker can reach that host over the network. The listener binds to 0.0.0.0, making it reachable on all network interfaces rather than only localhost.
Does exploitation require credentials or another authentication step?
No. Both the command-execution POST handler and the environment-disclosure GET handler have no handshake, token, or authentication check.
What can an attacker do through the listener?
A POST request can supply a q field that is passed to os.popen, allowing command execution and returning standard output, standard error, and the exit code. A GET request returns environment variables along with the hostname, user, current working directory, and platform information.
How can I check whether a host is affected?
Check whether twitter-request-diagnostics is installed and whether a process is listening on 0.0.0.0:7331. Affected instances expose the described behavior after the package's init() entrypoint runs.