MalwarePublished 30 Sep 2026

bfox-build-utils (PyPI) · Malicious Code

Affects bfox-build-utilsSource GCVE Database

Malicious package : remove bfox-build-utils and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:40 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-17319

What to do

Remove bfox-build-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIbfox-build-utils	Affected =1.0.997	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bfox-build-utils Python package (version 1.0.997) contains malicious code in its setup.py script that steals GitHub credentials during installation. It uses these credentials to clone the installer's repository, create a new branch, and inject a persistent attacker-controlled GitHub Actions workflow. This workflow executes on future pushes to the planted branch, enabling ongoing unauthorized actions. The package itself appears innocuous, with a minimal Python module and misleading branch and commit names to conceal the malicious behavior.

Impact

This vulnerability allows an attacker to steal GitHub credentials from the environment of anyone installing the package and use those credentials to inject malicious GitHub Actions workflows into the victim's repository. This can lead to persistent unauthorized code execution within the victim's CI/CD pipeline, potentially compromising the integrity and security of the repository and its workflows.

Defensive guidance

Users should avoid installing bfox-build-utils version 1.0.997 and audit their repositories for unauthorized GitHub Actions workflows, especially branches named 'feature/ci-health-check'. Review and revoke any compromised GitHub tokens and credentials. Monitor repository workflows for suspicious activity.

Summary

At install time, the setup.py script of bfox-build-utils (version 1.0.997) harvests the installer's GitHub credentials by reading the GitHub Actions environment configuration and environment variables. It extracts and decodes the authorization token, then uses it to clone the installer's repository. The script creates a branch named 'feature/ci-health-check', writes a malicious GitHub Actions workflow file, commits it as 'github-actions[bot]', and pushes the changes, bypassing API restrictions that normally protect workflow files. This results in a persistent, attacker-controlled workflow that executes on future pushes to the injected branch. The shipped Python module is a minimal stub, serving as a cover for the malicious payload in setup.py.

References

pypi.org/project/bfox-build-utils/1.0.997/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:40 UTC

Technical details

References

Community reviews