Vibe trading AI contains multiple critical vulnerabilities that allow unauthenticated remote attackers to execute arbitrary shell commands as root via LLM-callable tools. The BashTool, BackgroundRunTool, and other components execute commands without filtering or validation, enabling command injection, code injection, and SSRF. These vulnerabilities are reachable from any anonymous TCP client due to an unauthenticated API endpoint and lack of operator opt-in gating. Prompt injection attacks can also trigger arbitrary command execution by embedding malicious instructions in documents processed by the LLM agent. The vulnerabilities affect versions from 0.1.0 up to but not including 0.1.7. A patch is available to remediate these issues.
The voxeval package on PyPI versions 0.4.2 through 0.4.5 contains malicious code that deploys a cryptocurrency miner instead of providing legitimate functionality. This is a malicious campaign identified as 2026-10-voxeval with clear intent to misuse victim resources for cryptomining.
The dedh-devops-automation package on PyPI contains malicious code that executes during installation. It deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate sensitive data. The package overrides the install command in setup.py to perform these malicious actions. Multiple versions of the package are affected, including 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, and 5.9.0. This campaign is identified as having clear malicious intent, targeting cloud tokens and credentials.
The spo365-graph package on PyPI contains malicious code introduced in version 1.1.2 that executes during installation. This code deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate other sensitive data. The package overrides the install command in setup.py to carry out these malicious actions.
friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f)
The package presents itself as 'Small greeting utilities' but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer's Snowflake OAuth session token, calls snowflake.connector.connect with authenticator='oauth' and role='ACCOUNTADMIN', then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN='arn:aws:iam::631484165566:role/pentests_s3_role', and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer's Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage. The obfuscation (gzip+base64+exec), the cover-story package description, and the hardcoded attacker S3 bucket and IAM role are consistent with a Snowflake-targeted data-theft payload.
## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381)
The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-friendly-greeting-tools
Reasons (based on the campaign):
- exfiltration-generic
- obfuscation
The friendly-greeting-tools package on PyPI, versions 0.1.0 through 0.3.7, contains malicious code disguised as a hello-world demo. It exfiltrates Snowflake session tokens, connection configurations, dbt profiles, and pip configurations by encrypting and storing them in a workspace directory. Additionally, it uses stolen credentials with high privileges to copy sensitive data from a Snowflake warehouse table to an attacker-controlled AWS S3 bucket. The package employs obfuscation techniques and includes misleading documentation to conceal its hostile intent.
The Python package beautifytext version 1.0.3 (and also 1.0.4 and 1.0.7) contains a malicious backdoor. Upon import or installation, it spawns a detached background process that registers the host with a remote command and control (C2) server and polls it for commands. This backdoor can execute arbitrary shell commands, read and write files on the infected host, and exfiltrate results to the attacker-controlled server. The malicious behavior activates both on import and during package installation, making it stealthy and persistent.
The PyPI package 'cleanup-string' version 1.0.0 includes a suspicious Windows-only native extension protected by VMProtect, a tool used to obfuscate and virtualize code to prevent analysis. Although the package claims to be a pure-Python string helper, it loads a large opaque binary module with no clear legitimate purpose. This module executes with the privileges of the importing process in any Windows Python 3.13 environment, potentially enabling malicious activity.
The bfox-build-utils Python package (version 1.0.997) contains malicious code in its setup.py script that steals GitHub credentials during installation. It uses these credentials to clone the installer's repository, create a new branch, and inject a persistent attacker-controlled GitHub Actions workflow. This workflow executes on future pushes to the planted branch, enabling ongoing unauthorized actions. The package itself appears innocuous, with a minimal Python module and misleading branch and commit names to conceal the malicious behavior.
The PyPI package 'queeuees' version 0.0.1 contains obfuscated malicious code that executes at import time. The package ships two similarly named top-level packages with identical payloads that decode and execute hidden code via complex byte transformations. This code modifies the system by iterating over Python files and adding comments without user consent. The package metadata misleads users by advertising itself as a basic calculator. The obfuscation and unauthorized system modifications indicate clear malicious intent.
## Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation
of the Authorization Code Grant flow. The `code_challenge_method_plain` function
uses Python's standard `==` operator for string comparison instead of a
constant-time comparison function, potentially allowing timing-based attacks.
## Affected Component
- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`
- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`
- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
## Technical Details
Python's `==` operator uses short-circuit evaluation when comparing strings:
1. Returns `False` immediately if lengths differ
2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix
between the attacker-supplied verifier and the stored challenge, creating a
measurable timing oracle.
## Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate
pure Python execution time):
| Input | Result | Time (10M iterations) |
|---|---|---|
| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |
| 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s |
| **Difference** | | **0.03741s** |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences
per call, which are statistically exploitable under controlled conditions.
## Attack Scenario
1. Attacker intercepts `authorization_code` via Custom URI Scheme Hijacking
2. PKCE blocks token request — attacker lacks `code_verifier`
3. Attacker sends repeated requests to `/token` endpoint measuring response times
4. Using timing oracle, attacker recovers `code_verifier` character by character
5. Attacker obtains Access Token → Account Takeover
> **Note:** Practical exploitability is limited due to the single-use nature of
> authorization codes and real-world network noise. However, the vulnerable
> pattern should be corrected as a defense-in-depth measure.
## Recommended Fix
Replace `==` with `hmac.compare_digest()` for constant-time comparison:
cr: Elvin Latifli
Oauthlib's RevocationEndpoint with JSONP enabled (enable_jsonp=True) reflects the user-supplied callback parameter directly into JavaScript responses without validation. This allows attackers who can influence the callback parameter to inject arbitrary JavaScript code into the response, leading to unsafe JSONP usage. The vulnerability affects oauthlib versions from 0.6.1 up to but not including 4.0.0. The issue is fixed in version 4.0.0.
PyJWT versions 2.9.0 through 2.13.0 contain a vulnerability where a malformed RSA JWK in a JWK Set causes the entire set parsing to abort due to an uncaught ValueError. This happens because the ValueError raised by the cryptography library during RSA key recovery is not caught by PyJWT's exception handling, leading to denial of service in key processing.
The aseity package on PyPI version 0.1.0 contains malicious code that executes automatically during installation and import. It uses obfuscated and encoded payloads to deploy a multi-stage malware dropper that downloads additional components from a suspicious domain. The malware performs VM and debugger checks, extracts and runs a hidden Python executable, and includes an infostealer that exfiltrates data to a command-and-control server referenced via blockchain transactions. The package employs steganography and native extensions to evade detection and persist on the infected host.
The coinscan package on PyPI (version 0.1.0) contains malicious code that executes encrypted payloads during installation. It fetches an encrypted payload from a suspicious external domain and decrypts it with a hardcoded key, executing the code via exec(). If the network fetch fails, it falls back to a local encrypted payload, ensuring execution even offline. The payload includes sandbox evasion techniques to avoid detection in CI/build environments and targets developer workstations. Additionally, the package uses obfuscation and steganography to hide an infostealer that exfiltrates sensitive data to a command-and-control server referenced via the Polygon blockchain.
The claudedashbord package on PyPI contains malicious code that executes automatically on every Python interpreter startup via a .pth file. It fetches and executes remote code from a hardcoded non-publisher endpoint, enabling arbitrary code execution on the victim's machine. The malware includes anti-analysis features to evade sandbox detection and delays execution to avoid dynamic analysis. Additionally, obfuscated code and a native extension module act as an infostealer, exfiltrating sensitive data to a command-and-control server whose address is derived from blockchain transaction history. The package versions 0.1.0 through 0.1.3 are affected.
The PyPI package 'donutpromotion' version 0.1.0 contains malicious code that executes arbitrary payloads during installation. It fetches a remote JSON manifest or falls back to an embedded encrypted payload, decrypts it, and executes it, enabling arbitrary code execution. The malicious behavior is triggered only on developer workstations by checking for user directories and environment variables to evade sandbox detection. The package also includes an obfuscated native extension infostealer that exfiltrates sensitive data to a command-and-control server via blockchain transactions. The README falsely advertises offline Minecraft helper functionality, inconsistent with the malicious network activity.
The metrio package on PyPI, specifically versions 999.0.0, 1000.0.0, and 1001.0.0, contains malicious code that exfiltrates the local machine's hostname during installation and import. This exfiltration occurs by encoding the hostname and sending DNS and HTTP requests to an attacker-controlled domain. The package is designed as a dependency confusion proof-of-concept, aiming to be resolved instead of an internal package with the same name, thereby leaking information about the resolving host.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb)
setup.py invokes a module-level _trigger() that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run(), which downloads https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png, locates a ZIP local-file header (PK\x03\x04) or EOCD (PK\x05\x06) appended after the PNG data, extracts the trailing archive to a temp directory, and spawns the Python interpreter detached against the extracted AppHost/main.py with a DAS_STAGED environment variable used as a reentry guard. All errors are swallowed to keep the operation silent. The payload host is not the publisher's own domain, the URL is unversioned and not integrity-checked (no hash/signature), and the ZIP-appended-to-PNG packaging is a covert channel intended to disguise executable content as an image asset. A source-comment in setup.py explicitly acknowledges that module-level code runs in-process during PEP 517 wheel builds and states the intent to keep the fetch silent and non-blocking, so the dropper fires automatically on `pip install` with no further user action.
## Source: kam193 (c8af51da84b6b458a704ca222ba17f56d1158e0bfa52e0360aaeca4ae07c4cf8)
During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- obfuscation
- malware
- native-extension
- steganography
- c2-in-blockchain
- The package contains code to detect if it is running in a sandbox environment.
The requests-cache-utils package version 1.0.0 on PyPI contains malicious code that executes during installation. This code downloads and runs an infostealer designed to exfiltrate browser data. The package overrides the standard install command to perform these malicious actions.