django-b64-img

Details

**Severity:** Critical

**Affected versions:** `= 1.1`

## Source: kam193 (f5ebdaebc61cf7a888322348e074f219519b7d09a24ab91732d8bc5061d86b2e)
The package provides a special image-storing field for Django REST Framework based on a legitimate implementation from the Hipo/drf-extra-fields repository. The malicious modification appends the cloud credentials and full `settings` values to the serialized form of specific image types. This way, an attacker can retrieve sensitive values by downloading back once uploaded image.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-05-old-django-b64-img


Reasons (based on the campaign):


 - exfiltration-credentials


 - obfuscation


 - backdoor

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/django-b64-img/MAL-2026-3413.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/django-b64-img
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/django-b64-img/MAL-2026-3413.json
- https://github.com/advisories/GHSA-cfch-r329-4qxf

Compromised versions (1)

• = 1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.