Hostile 100% python Download

bfox-build-utils 1.0.999

setup.py exfiltrates GitHub token

“Build utilities”

setup.py filters credential-named environment values for a POSTRoot Python setup.py packaging file
SHA-2569820b5332547f1f48b32e82da9491acc7746d3e070e931f68bf9f6f8e661fb4d
URLhttps://files.pythonhosted.org/packages/68/ac/0adab18281c21343dd7765dfeec84da498f6fa722141d68a1d4cdc92ad96/bfox_build_utils-1.0.999.tar.gz
MaleculeO₃(S₂CaEu)H₄(Cm₇Db₃Os₃Po)Md₄(BkIn₃Pa₃)

Also flagged by osm (This package implements a CI/CD supply-chain poisoning attack. The setup.py, executing at install time, steals a GitHub token either from the GITHUB_TOKEN environment variable or by parsing a base64-e…) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.