---
id: MAL-2026-15566
title: Malicious code in flask-header-guard (PyPI)
summary: Malicious code in flask-header-guard (PyPI)
severity: none
vendor: flask-header-guard
product: flask-header-guard
ecosystem: pip
affected:
  - flask-header-guard
published: '2026-08-29'
updated: '2026-08-29'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-15566'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/flask-header-guard'
tags:
  - osv
  - pip
ingestedAt: '2026-08-29T19:29:14.721Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (d050fa5a7000088c15b40b82ace014d66f18520ff36464659c8ad6e999ee83cb)
During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open a reverse shell. Additionally, the provided Flask middleware embeds a backdoor.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-pygame-renderkit


Reasons (based on the campaign):


 - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.


 - files-exfiltration


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - exfiltration-env-variables


 - persistence


## Affected packages

- `flask-header-guard`

## Remediation

Refer to the advisory for the patched release.