MAL-2024-12269

    Dashboard / Malicious Package / MAL-2024-12269

    MAL-2024-12269

    Published: 25 Sept 2024Last Modified: 12 Dec 2025

    Summary: Malicious code in faest (PyPI)

    Details: Source: kam193 (f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781) When using this library to do any request, a "validate_origin" function is called (L1320 in _client.py). This method, located in _utils.py, collects all request data, tries also read /etc/shadow using Docker container, and sends them to an endpoint controlled by the package author. The package seems to be a clone of httpx and also informs in the README that it's a malicious library, as so, it seems to be a malicious research attempts. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-old-faest Reasons (based on the campaign): - exfiltration-generic - action-hidden-in-lib-usage - clones-real-package

    References: https://bad-packages.kam193.eu/pypi/package/faest

    Affected packages

    Package

    Name: faest

    Purl: pkg:pypi/faest

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.14.6
    MAL-2024-12269 | CVE-DB