{"id":"MAL-2026-4776","summary":"Malicious code in whatsfly-labfox (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f)\nOn `import whatsfly`, `whatsfly/__init__.py` invokes `ensureUsableBinaries()` from `whatsfly/dependencies/builder.py`, which downloads a native binary (`.so`/`.dll`/`.dylib`) from the GitHub Actions artifacts API for `Labfox/whatsfly`, unzips it under `whatsfly/dependencies/whatsmeow/`, and `whatsmeow.py` loads it directly via `ctypes.CDLL(...)`. The download is authenticated with a fine-grained GitHub Personal Access Token (`github_pat_11AZ7BYQI05SxpWYyU3Ctr_e2PlN...`) reconstructed at runtime from a per-character list in `whatsfly/dependencies/github_actions_download.py:7` — a deliberate obfuscation pattern used to evade GitHub's automated secret scanning. Two installer-impacting consequences follow: (1) every installer extracts the same live GitHub PAT and can use it against the author's GitHub account and the `Labfox/whatsfly` repository (credential redistribution to third parties); (2) the fetched artifact is a GitHub Actions artifact (mutable, 90-day TTL) pinned only by the loose string `version=\"v20\"` with no hash or signature verification — anyone holding the PAT (including any installer of this package) can replace the artifact and achieve remote code execution on every subsequent importer via the ctypes load.\n","modified":"2026-06-15T03:00:55.076006836Z","published":"2026-05-24T16:52:10Z","database_specific":{"malicious-packages-origins":[{"sha256":"44d4a24d293f810bd11587936b79a835fb0671b7af961328f836d57c7b0c4514","import_time":"2026-05-26T05:52:45.573627433Z","id":"IN-MAL-2026-004517","modified_time":"2026-05-24T16:52:15Z","versions":["0.2.0"],"source":"amazon-inspector"},{"id":"IN-MAL-2026-004515","modified_time":"2026-05-24T16:52:10Z","versions":["0.2.1"],"source":"amazon-inspector","sha256":"68fe57da48ce63ec7cec5176168ccdfbe05e8b6f83a83c39a0440289141ee2d1","import_time":"2026-05-26T05:52:45.372852238Z"},{"import_time":"2026-05-26T05:52:45.467178562Z","id":"IN-MAL-2026-004516","modified_time":"2026-05-24T16:52:15Z","versions":["0.2.0"],"source":"amazon-inspector","sha256":"c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f"},{"import_time":"2026-05-26T05:52:45.724484249Z","id":"IN-MAL-2026-004518","modified_time":"2026-05-24T16:52:19Z","versions":["0.2.1"],"source":"amazon-inspector","sha256":"f6aa24abde03297259d087a25b56eaa29010b3d2857599bbe9fbe0b60af92959"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/whatsfly_labfox/0.2.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/whatsfly_labfox/0.2.0/"}],"affected":[{"package":{"name":"whatsfly-labfox","ecosystem":"PyPI","purl":"pkg:pypi/whatsfly-labfox"},"versions":["0.2.0","0.2.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/whatsfly-labfox/MAL-2026-4776.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"whatsfly_labfox-0.2.1-py3-none-any.whl","hashes":{"sha256":"52c4e400727c69f583c2202cebbaa6e366e24af5f235062ad3cba01f1fbb9b9e","blake2b_256":"60d2bd37c3c8f783b75ea5a429ef9099b97bb95a542cfa47649a3282c7df669e","md5":"501131cc673fd42799b0e8c764076e65"}},{"hashes":{"blake2b_256":"620feca1907290d22e6e2b9f5c6cef0a2db34ef3355e25b31c84ecf3aac78a9e","md5":"8beb276fb18b3c2a1ac67026940fd4fe","sha256":"7a60d1c1f060b6aa6026f515cd3bd553235731c39272aaa894e3b10854c216c2"},"filename":"whatsfly_labfox-0.2.1.tar.gz"}],"domains":["api.github.com"],"evidence_files":[{"path":"whatsfly/dependencies/github_actions_download.py","sha256":"f88963d32091922133fe8f29fea794225ba9328cf89f4e9528606dc64daac2a2","tlsh":"28214245861d74328b522f9849e58c273768e557e100b1b6bebc43fd6fc849c43e76c9"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}