MAL-2026-6382

Dashboard / Malicious Package / MAL-2026-6382

MAL-2026-6382

Summary: Malicious code in fkaks (PyPI)

Details: Source: amazon-inspector (e44e1f1158eda01d3f18e3a3c01e30ebc9f8f92780ea532a63cf6ed31d8a25d3) fkaks 0.0.1 ships a setup.py that overrides the install and egg_info commands so that any `pip install` or `pip download` of the package unconditionally executes a curl POST to a hardcoded out-of-band collector at http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun. The POST body is built by iterating the entire `os.environ` mapping (`env_vars_string = "&".join([f"{key}={value}" for key, value in env_vars.items()])`) and concatenating it with the output of `ps -elf`, harvesting whatever secrets the installer or CI host has in environment variables (cloud credentials such as AWS_*, GitHub/registry tokens, CI secrets, SSH agent paths) along with a full process listing. The transport is plaintext HTTP to an interactsh-style oast.fun subdomain — infrastructure typical of OOB exfiltration callbacks. The README's framing of the package as a demo of automatic code execution on pip install does not change the on-the-wire behavior: every installer is attacked. Source: kam193 (69b5a350ae8e5977b5d55e55ac57fb8d3e7c5b72b9d026596ffafeae8996daaf) During installation, the package exfiltrates env variables Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-ip-rotat Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-env-variables - typosquatting

References: https://bad-packages.kam193.eu/pypi/package/fkaks, https://pypi.org/project/fkaks/0.0.1/