Malicious code in fabtoolkit (PyPI)

fabtoolkit is a malicious PyPI package that runs a payload via subprocess executing embedded Python code. This payload downloads a JSON config from https://transfer.archivete.am with SSL verification disabled, then performs actions based on config 'kind' values: reading arbitrary filesystem paths, running attacker-supplied commands, making HTTP requests with stolen Bearer tokens, probing TCP ports, and running a reverse shell daemon that polls attacker-controlled commands and sends back output. It collects sensitive files including AWS and SSH credentials and cloud metadata, packages them into an in-memory zip, and uploads them to the attacker’s public file-transfer host. The payload kills processes with specific cmdline patterns to maintain persistence and avoid multiple instances. The malicious behavior triggers on running the package or importing certain functions. The package has no legitimate use.

The malicious package enables attackers to execute arbitrary commands, steal sensitive credentials and cloud metadata, perform network reconnaissance, and maintain persistent remote shell access on compromised systems. This can lead to full system compromise, data exfiltration, and further lateral movement within affected environments.

No official patch or remediation is indicated. The package fabtoolkit should be considered malicious and removed immediately from any environment where it is installed. Avoid installing packages from untrusted sources and verify package integrity before use. Monitor for and remove any processes related to fabtoolkit. Since this is a malicious package, no legitimate fix exists; remediation involves removal and blocking the package from use.