Malicious code in fflask (PyPI)

Overview

---

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (125471d3fb13da284e2a1e6f08627065506454ba819af239105d536da0854c74)

Source: kam193 (106052056ac243ab1b11c7bbf3a04ff9f1b408cf92616fa635242b4230490d2f)

Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-12-reqesst

Reasons (based on the campaign):

• infostealer

• peristence-autorun

• typosquatting

• exfiltration-generic

• Downloads and executes a remote executable.

• clones-real-package

• dependency-confusion

• exfiltration-browser-data

• exfiltration-crypto

---

Credit: OpenSSF (source)

Source: kam193 (106052056ac243ab1b11c7bbf3a04ff9f1b408cf92616fa635242b4230490d2f)

Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-12-reqesst

Reasons (based on the campaign):

• infostealer

• peristence-autorun

• typosquatting

• exfiltration-generic

• Downloads and executes a remote executable.

• clones-real-package

• dependency-confusion

• exfiltration-browser-data

• exfiltration-crypto

Affected packages

• fflask

Remediation

Refer to the advisory for the patched release.