MAL-2026-17455

    Dashboard / Malicious Package / MAL-2026-17455

    MAL-2026-17455

    Published: 2 Oct 2026Last Modified: 8 Oct 2026

    Summary: Malicious code in dedh-devops-automation (PyPI)

    Details: Source: amazon-inspector (35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76) The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722) During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-spo365-graph Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-cloud-tokens - exfiltration-credentials - targetted-attack

    References: https://bad-packages.kam193.eu/pypi/package/dedh-devops-automation, https://pypi.org/project/dedh-devops-automation/5.8.0/, https://pypi.org/project/dedh-devops-automation/5.6.999/, https://pypi.org/project/dedh-devops-automation/5.8.1/, https://pypi.org/project/dedh-devops-automation/0.0.1/, https://pypi.org/project/dedh-devops-automation/5.0.0/, https://pypi.org/project/dedh-devops-automation/5.6.0/, https://pypi.org/project/dedh-devops-automation/5.9.0/, https://pypi.org/project/dedh-devops-automation/5.6.1/

    Affected packages

    Package

    Name: dedh-devops-automation

    Purl: pkg:pypi/dedh-devops-automation

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1