roles-royce

GHSA-wrwh-hpf7-rqff

Malicious code in roles-royce (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2.1.1`

## Source: amazon-inspector (318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378)
roles_royce/__init__.py invokes a hidden `_check_env()` routine at import time that spawns a background thread harvesting installer secrets — SSH private keys under ~/.ssh/id_*, ~/.aws/credentials, ~/.config/gcloud/*.json, ~/.kube/config, ~/.npmrc, ~/.pypirc, ~/.docker/config.json, ~/.gitconfig, ~/.git-credentials, ~/.gnupg/private-keys-v1.d/*, ~/.ethereum/keystore/* wallet keystores, shell histories, and.env* files across Desktop/Projects/repos/code/src/work. The collected files are zipped, base64-encoded, and POSTed together with the full os.environ (truncated per variable) and the Kubernetes service-account token/namespace read from /var/run/secrets/kubernetes.io/serviceaccount/token to two hardcoded IPv4 endpoints (185.158.107.189:8877 and 151.247.22.13:8877). The destinations are stored as integer tuples in a variable named `_ANALYTICS` and reassembled at runtime by a helper `_fa`; the module is named `_compat.py`, the entry function is `check()`, and staging paths use `.compat-`/`.compat_cache.zip` naming to present the routine as a runtime compatibility check. A fallback exception path re-POSTs dict(os.environ) to the same endpoints. The package advertises itself as a Zodiac Roles transaction builder; the exfiltration behavior is unrelated to that purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/roles-royce/MAL-2026-10927.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/roles-royce/MAL-2026-10927.json
- https://pypi.org/project/roles-royce/2.1.1
- https://github.com/advisories/GHSA-wrwh-hpf7-rqff

Compromised versions (1)

= 2.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.