The dedh-devops-automation PyPI package contains embedded malicious code that activates during the installation process by overriding the setup.py install command. This code deploys a rogue AWS Lambda function which collects credentials from AWS Secret Manager and other data, subsequently exfiltrating this information. The campaign associated with this package is labeled '2026-10-spo365-graph' and is characterized by targeted attacks aimed at stealing cloud tokens and credentials. Multiple specific versions of the package are known to be affected.

Successful installation of the affected dedh-devops-automation package results in unauthorized deployment of a rogue AWS Lambda function that can access and exfiltrate sensitive AWS credentials and other data. This compromises the confidentiality of cloud secrets and potentially enables further unauthorized access to cloud resources. The malicious behavior occurs silently during installation, increasing the risk of unnoticed credential theft.

No official patch or remediation guidance is provided in the available data. Users should avoid installing the affected versions of the dedh-devops-automation package. Review and remove any deployments of the rogue AWS Lambda function if detected. Monitor AWS environments for unauthorized Lambda functions and credential access. Check the vendor or PyPI advisories for updates or official remediation steps. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.