Malicious code in dbt-sa-cli (PyPI)

The dbt-sa-cli PyPI package version 0.0.1 includes a setup.py script that defines and immediately invokes a function (rce_poc) during installation. This function collects installer-side system information (hostname, username, current working directory, home path) and sends it out-of-band via DNS lookups and HTTPS POST requests to a subdomain controlled by the attacker. Additionally, it creates a marker file (~/.dbt-sa-cli-rce-poc) to demonstrate arbitrary code execution on the installer's machine. The package name is a typosquat of the legitimate dbt ecosystem, aiming to deceive users. The package serves no legitimate purpose beyond data exfiltration and code execution during install.

Installing or importing the dbt-sa-cli package version 0.0.1 results in immediate disclosure of system information to an attacker-controlled server and arbitrary code execution on the installer's system. This compromises the confidentiality of host identifiers and allows execution of unauthorized code during package installation. There is no evidence of further payloads or persistence mechanisms beyond the marker file. No known exploits in the wild have been reported.

No official patch or remediation is available. Users should avoid installing or importing the dbt-sa-cli package version 0.0.1 from PyPI. Verify package names carefully to avoid typosquatting attacks, especially for packages resembling popular ecosystems like dbt. If this package has been installed, remove it and investigate the system for any unauthorized changes or data exfiltration. Monitor for suspicious DNS or HTTPS traffic to unknown domains.