Benign python Download

slack-mpm 0.1.7

Legitimate Slack MCP server package

Webshell file manager payload buildersPython __import__ call

SHA-256e1ea2bb9997c740cbdee863d96f6bbf6dfd0f860bd7f3528e3d462d709210687

URLhttps://files.pythonhosted.org/packages/50/a1/9535a628c1bed3c862c1c64df944dbba2947e11def71eb9e4db1d048cd92/slack_mpm-0.1.7-py3-none-any.whl

MaleculeO(C)H₂(CmPo)

Evidence

Webshell file manager payload builders files.py · lines 17–20

17async def upload_file(
  token: str,
  channels: list[str],
  content: str | bytes | None = None,

httpx.AsyncClient usage files.py · lines 100–103

  # Step 2: Upload the file bytes to the provided URL
  async with httpx.AsyncClient(timeout=60.0) as client:
      upload_resp = await client.post(
          upload_url,

Credential-access vocabulary word: secret files.py · lines 152–154

  Args:
      token: Slack bot token.
      file: File ID (e.g., 'F1234567890').  # pragma: allowlist secret

Python __import__ call main.py · lines 110–116

  for name, module in deps.items():
      try:
          __import__(module)
          click.echo(f"  {name}: [{click.style('OK', fg='green')}]")
      except ImportError:
          click.echo(f"  {name}: [{click.style('MISSING', fg='red')}]")
          all_deps_ok = False

OAuth protocol reference models.py · lines 21–27

⋯4 lines
  user_id: str | None = Field(default=None, description="User ID associated with token")
  bot_id: str | None = Field(default=None, description="Bot ID (for bot tokens)")
  scopes: list[str] = Field(default_factory=list, description="OAuth scopes granted")

No evidence locations were recorded for this file. Raw result