{"id":"MAL-2026-17419","summary":"Malicious code in friendly-tools (PyPI)","details":"friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f)\nThe package presents itself as 'Small greeting utilities' but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer's Snowflake OAuth session token, calls snowflake.connector.connect with authenticator='oauth' and role='ACCOUNTADMIN', then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN='arn:aws:iam::631484165566:role/pentests_s3_role', and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer's Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage. The obfuscation (gzip+base64+exec), the cover-story package description, and the hardcoded attacker S3 bucket and IAM role are consistent with a Snowflake-targeted data-theft payload.\n\n## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381)\nThe package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-friendly-greeting-tools\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-generic\n\n\n - obfuscation\n","modified":"2026-10-02T05:01:12.610551681Z","published":"2026-10-01T12:04:42Z","database_specific":{"iocs":{"urls":["s3://pkusinski-external/"]},"malicious-packages-origins":[{"id":"pypi/2026-09-friendly-greeting-tools/friendly-tools","import_time":"2026-10-01T12:30:03.199372251Z","modified_time":"2026-10-01T12:08:07.778244Z","sha256":"969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381","source":"kam193","versions":["0.1","0.2"]},{"source":"amazon-inspector","versions":["0.2"],"id":"IN-MAL-2026-020866","import_time":"2026-10-01T17:18:04.161966185Z","modified_time":"2026-10-01T17:02:11Z","sha256":"71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f"},{"source":"amazon-inspector","versions":["0.1"],"id":"IN-MAL-2026-020865","import_time":"2026-10-01T17:18:04.004604796Z","modified_time":"2026-10-01T17:02:00Z","sha256":"6b9e176dd869e9177dc1a282626cb40f2bb3eac2822fda39e29ef4bd19db79f8"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/friendly-tools"},{"type":"PACKAGE","url":"https://pypi.org/project/friendly-tools/0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/friendly-tools/0.1/"}],"affected":[{"package":{"name":"friendly-tools","ecosystem":"PyPI","purl":"pkg:pypi/friendly-tools"},"versions":["0.1","0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"blake2b_256":"07bae7351f120d71bbfb59ebd09a9f092bcca4b2c95a84d90f8be7d3767e6cc4","md5":"2170b8bb1747b00f4cdb4a25f5f5cbd9","sha256":"82eacfa153a3c966bbf615207925bdc511f67fbe61db7f4820edbc4302f62965"},"filename":"friendly_tools-0.2-py3-none-any.whl"},{"hashes":{"md5":"ec41e35954b4b34135be284731c9a4db","sha256":"a563e95fe3e3da943045bfbd58ef30ca39e2a8fbb2f3b868e0c0fc31b276c904","blake2b_256":"c24818dc9616b8eb916d17f568123e450b4c06f17a86469029b5e2a47b547cfe"},"filename":"friendly_tools-0.2.tar.gz"}],"evidence_files":[{"path":"src/friendly_greeting/main.py","sha256":"4b88379a3311a225e00d24ebf1884e3a5257fba880884d521249c6e2c7dae5a9","tlsh":"36511c31644e0eb36b5b08bc1c6db6948e36391b2014ad307d5c53b53f2dabe84b76a4"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/friendly-tools/MAL-2026-17419.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"smiling-hyena","contact":["smilinghyena4@gmail.com"],"type":"FINDER"}]}