MAL-2026-3148

    Dashboard / Malicious Package / MAL-2026-3148

    MAL-2026-3148

    Published: 29 Apr 2026Last Modified: 29 Apr 2026

    Summary: Malicious code in amazon-boto (PyPI)

    Details: Source: kam193 (649bb559f3078565515a9fee16dbe78e0d1b5575943cbaf020135f8e70e2f17d) When using the package, the given AWS credentials are silently exfiltrated to a hardcoded location. This incarnation of the long-running campaign was first flagged by OpenSourceMalware https://opensourcemalware.com/pypi/amazon-boto Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-aws-enumerate Reasons (based on the campaign): - exfiltration-generic - action-hidden-in-lib-usage - exfiltration-credentials

    References: https://bad-packages.kam193.eu/pypi/package/amazon-boto

    Affected packages

    Package

    Name: amazon-boto

    Purl: pkg:pypi/amazon-boto

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.42.41
    1.42.42