Hostile 100% python Download

bfox-build-utils 1.0.997

Exfiltrates token, pushes malicious workflow

“Build utilities”

setup.py filters credential-named environment values for a POSTRoot Python setup.py packaging file
SHA-256b43d470d00faeffe486d550271e4096ab57b28b98d5af1624a8c0e39e62dbbb3
URLhttps://files.pythonhosted.org/packages/1d/3b/4905e852ca5a65902f26f3cecc7ed8f5082dae5fa01cdb4ec5b0fd903a0e/bfox_build_utils-1.0.997.tar.gz
MaleculeO₃(S₃CaEu)H₅(Cm₈Db₈F₃Os₃Po₄)Md₄(BkIn₅Pa₃)

Also flagged by osm (This package implements a CI/CD supply-chain poisoning attack. The setup.py, executing at install time, steals a GitHub token either from the GITHUB_TOKEN environment variable or by parsing a base64-e…), osv (MAL-2026-17319: Malicious code in bfox-build-utils (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.