django-b64-img

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (f5ebdaebc61cf7a888322348e074f219519b7d09a24ab91732d8bc5061d86b2e)
The package provides a special image-storing field for Django REST Framework based on a legitimate implementation from the Hipo/drf-extra-fields repository. The malicious modification appends the cloud credentials and full `settings` values to the serialized form of specific image types. This way, an attacker can retrieve sensitive values by downloading back once uploaded image.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-05-old-django-b64-img


Reasons (based on the campaign):


 - exfiltration-credentials


 - obfuscation


 - backdoor

Compromised versions (1)

• 1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.