Malicious code in yamlformat-tools (PyPI)

The yamlformat-tools PyPI package version 0.1.0 includes malicious code that, upon import, collects sensitive data and exfiltrates it using DNS queries. This exfiltration technique is generic but effective for credential theft and targeted attacks. The campaign associated with this package is identified as 2026-08-ekx-report-utils, categorized under malicious intent with targeted attack and credential exfiltration characteristics. No official patch or fix is available, and the package should be considered unsafe.

Sensitive information and credentials can be exfiltrated from systems that import the yamlformat-tools package version 0.1.0. This can lead to compromise of user data and potentially broader system or network breaches if credentials are reused or privileged.

Avoid using the yamlformat-tools package version 0.1.0. Remove it from any environments where it is installed. Since no patch or fix is available, the best mitigation is to not install or to uninstall this package. Monitor for any use of this package in your supply chain or development environments.