easypydb

GHSA-7c8r-rg7j-5wwc

Malicious code in easypydb (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.4.4`

## Source: kam193 (6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a)
The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by people and sends them to a Discord webhook, effectively allowing stealing data.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2024-09-old-easypydb


Reasons (based on the campaign):


 - action-hidden-in-lib-usage


 - exfiltration-generic


 -

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/easypydb/MAL-2024-12261.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/easypydb
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/easypydb/MAL-2024-12261.json
- https://github.com/advisories/GHSA-7c8r-rg7j-5wwc

Compromised versions (1)

= 0.4.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.