{"id":"MAL-2026-17926","summary":"Malicious code in fabdeploycheck (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857)\nThe package's only public API, check(), spawns a Python child that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json using ssl._create_unverified_context() and dispatches handlers under remote control. A 'revsh' handler double-forks + setsid to daemonize, polls \u003cbase\u003e/\u003cid\u003e-cmd.txt for commands, executes each fetched string via /bin/sh -c, and PUTs stdout/stderr back as \u003cid\u003e-out.txt — a full reverse-shell channel on the installer host. Additional handlers permit arbitrary file reads (kind='file' opens any path on disk), arbitrary process execution (kind='run' with attacker-supplied argv), TCP probing (kind='tcp'), and HTTP calls with Bearer tokens chained from previously-read files (kind='http'); collected results are zipped and PUT to the same anonymous file host under an attacker-chosen report name. Before launching the daemon the child walks /proc and SIGKILLs any process whose cmdline contains 'FABDRV3', 'fabdrv2', or 'connection ready' — housekeeping to replace prior implant generations and consistent with a self-named, iterated backdoor family. The control URL is anonymous, mutable, and reached with TLS verification disabled, so the operator of that path (or any MITM) obtains unauthenticated code execution on every host that invokes check().\n","modified":"2026-10-19T02:30:03.430986255Z","published":"2026-10-19T02:26:39Z","database_specific":{"malicious-packages-origins":[{"versions":["0.1.1"],"id":"IN-MAL-2026-021524","import_time":"2026-10-19T02:27:23.751305115Z","modified_time":"2026-10-19T02:26:39Z","sha256":"73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/fabdeploycheck/0.1.1/"}],"affected":[{"package":{"name":"fabdeploycheck","ecosystem":"PyPI","purl":"pkg:pypi/fabdeploycheck"},"versions":["0.1.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"96161cb2ff7d91e1b156242ea76bd1ae2dbc02395e7139194c59820f59fd6d9a","tlsh":"32e16312981a2472d283e53cac30c9567b56fd1b91039c717edc9ba49fc84b7c1b27ba","path":"fabdeploycheck/__init__.py"}],"package_integrity":[{"filename":"fabdeploycheck-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"21c92fce4dde9d7660fb8134532d516f594092bca68de73e33915e2b3167c7ff","md5":"b32250d58a656d5b8dde3262de0b4286","sha256":"24cb59b96fdffe19dab2eae7903c2d15f00ef9f9d385507544e3d5b581596609"}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fabdeploycheck/MAL-2026-17926.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}