MAL-2026-18403

Dashboard / Malicious Package / MAL-2026-18403

MAL-2026-18403

Summary: Malicious code in twitter-request-diagnostics (PyPI)

Details: Source: amazon-inspector (8ca5b20afc78999f71a79a794a2369cfd98a2c54e4782800d52b18319d8ecb32) The package's init() entrypoint starts an HTTPServer bound to 0.0.0.0:7331 that implements two unauthenticated remote-access primitives against the installer's host. POST to the handler reads a 'q' field from the request body and passes it to os.popen, returning stdout, stderr, and the exit code to the caller; the os.popen lookup is obfuscated as getattr(__import__('os'), 'po' + 'pen') to defeat trivial string/AST scans. GET to the same endpoint returns a JSON blob containing dict(os.environ) plus hostname, user, cwd, and platform, exposing the installer's full environment (including any API keys, database URLs, and cloud credentials it holds) to any party that can reach the port. The /status (or /metrics) path and 'diagnostics' framing in the README do not restrict either behavior, and the package name misrepresents its function. There is no handshake, token, or auth check on either verb, and the bind address makes the listener reachable from every interface, not loopback. Source: kam193 (d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1) Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-test-01-rafamarrara-learning-dc Reasons (based on the campaign): - backdoor - exfiltration-env-variables

References: https://bad-packages.kam193.eu/pypi/package/twitter-request-diagnostics, https://pypi.org/project/twitter-request-diagnostics/1.0.0/