MAL-2026-15934

Dashboard / Malicious Package / MAL-2026-15934

MAL-2026-15934

Summary: Malicious code in dbt-sa-cli (PyPI)

Details: Source: amazon-inspector (9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a) setup.py defines rce_poc() and invokes it at module top level, so the code runs unconditionally during `pip install dbt-sa-cli`. The function collects installer-side identifiers (hostname, USER/USERNAME, current working directory, home path) and sends them out-of-band via a DNS lookup to a subdomain of yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun and an HTTPS POST to https://yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun/dbt-sa-cli. The same install-time path drops a marker file at ~/.dbt-sa-cli-rce-poc in the installer's home directory, demonstrating arbitrary code execution during install. The package name resembles the dbt ecosystem, making this a typosquat lure. Regardless of any 'security research' framing, installing the package produces immediate installer-side data disclosure and code execution against an author-controlled OOB collector. Source: kam193 (23702c2370cf8873f90f85f178de5d781c9244f91fe412c952fc3cca8e98f974) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

References: https://bad-packages.kam193.eu/pypi/package/dbt-sa-cli, https://pypi.org/project/dbt-sa-cli/0.0.1/