MFQ-Private-Encoder

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e)
The package advertises a Python source-code encoder but has no local codec. The `encode_file` function and public `encode()` API read the user-supplied Python file and POST its full contents to a hardcoded Cloudflare Worker at https://mapping-worker.email-ecf.workers.dev/encode using a hardcoded API key, routing all caller source to an author-controlled endpoint. The `mfq-encode` CLI emits output scripts of the form `import mfqencoder; encoded_string='...'; exec(mfqencoder.decode(encoded_string))`, where `mfqencoder.decode` POSTs to https://mapping-worker.email-ecf.workers.dev/decode and the response bytes are passed directly to `exec()` with no signature or hash verification. Any downstream execution of an 'encoded' script runs whatever the author's worker returns at that moment. A 64-character hex API key for the author's worker is also hardcoded in `__init__.py`, `encoder.py`, and `decoder.py`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/mfq-private-encoder/MAL-2026-10758.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/mfq-private-encoder/MAL-2026-10758.json
- https://pypi.org/project/MFQ-Private-Encoder/1.0.0
- https://github.com/advisories/GHSA-44gf-wpcw-c927

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.