Hostile 100% python Download

SPO365-GRAPH 1.1.2

Build-time AWS credential exfiltration

“Python client for SharePoint Online via Microsoft Graph API”

PKG-INFO privacy email (proton/tutanota)Root Python setup.py packaging file
SHA-2567acebd82867d0cbd20b951a1e4dd383935116b99c29959853fdded797cd5042d
URLhttps://files.pythonhosted.org/packages/b6/b8/3ff1e471cf3911711d530fa6eced94c554b4515fb72a311a971eb1f84773/spo365_graph-1.1.2.tar.gz
MaleculeO₄(AsCaEuS₃)H₇(Cm₂₀Cr₂Db₁₂F₂Os₅Po₃Ti)Md₄(BkIn₁₁Pa₄)

Also flagged by osm (During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data is then exfiltrated to custom AWS s3 endpoint), osv (MAL-2026-17421: Malicious code in spo365-graph (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.