friendly-tools

Details

**Severity:** Critical

**Affected versions:** `= 0.1`

## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381)
The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-friendly-greeting-tools


Reasons (based on the campaign):


 - exfiltration-generic


 - obfuscation

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af3e7b18d0e04aedeb9009af50f18a618b3da2d3/osv/malicious/pypi/friendly-tools/MAL-2026-17419.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/friendly-tools
- https://github.com/ossf/malicious-packages/blob/af3e7b18d0e04aedeb9009af50f18a618b3da2d3/osv/malicious/pypi/friendly-tools/MAL-2026-17419.json
- https://github.com/ossf/malicious-packages/blob/36871e857ba1837bcf8c863ac950d788e821bd5e/osv/malicious/pypi/friendly-tools/MAL-2026-17419.json
- https://pypi.org/project/friendly-tools/0.1
- https://pypi.org/project/friendly-tools/0.2
- https://github.com/ossf/malicious-packages/blob/4a4c6e9677b4a9d383802167510e64e4fa603e1f/osv/malicious/pypi/friendly-tools/MAL-2026-17419.json
- https://github.com/advisories/GHSA-8hwj-527f-mmvm

Compromised versions (1)

• = 0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.