MAL-2026-3413

    Dashboard / Malicious Package / MAL-2026-3413

    MAL-2026-3413

    Published: 10 May 2026Last Modified: 10 May 2026

    Summary: Malicious code in django-b64-img (PyPI)

    Details: Source: kam193 (f5ebdaebc61cf7a888322348e074f219519b7d09a24ab91732d8bc5061d86b2e) The package provides a special image-storing field for Django REST Framework based on a legitimate implementation from the Hipo/drf-extra-fields repository. The malicious modification appends the cloud credentials and full `settings` values to the serialized form of specific image types. This way, an attacker can retrieve sensitive values by downloading back once uploaded image. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-old-django-b64-img Reasons (based on the campaign): - exfiltration-credentials - obfuscation - backdoor

    References: https://bad-packages.kam193.eu/pypi/package/django-b64-img

    Affected packages

    Package

    Name: django-b64-img

    Purl: pkg:pypi/django-b64-img

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1
    MAL-2026-3413 | CVE-DB