Malicious code in flask-header-guard (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb)

During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pygame-renderkit

Reasons (based on the campaign):

• The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

• files-exfiltration

• The package overrides the install command in setup.py to execute malicious code during installation.

• exfiltration-env-variables

• persistence

Affected packages

• flask-header-guard

Remediation

Refer to the advisory for the patched release.