Malicious Code Injection in bfox-build-utils: Credential Theft and Workflow Manipulation
Summary
MAL-2026-17319: Malicious code in bfox-build-utils (PyPI). Affects bfox-build-utils versions 1.0.997. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bfox-build-utils is a Python package available on PyPI, designed to provide build utilities for developers. However, it has been compromised to include malicious code that exploits GitHub credentials during installation, allowing unauthorized modifications to the installer's repository.
Vulnerability Detail
The vulnerability originates from the setup.py script of the bfox-build-utils package. During installation, it harvests the installer's GitHub credentials from the environment and the Git configuration. It then uses these credentials to clone the installer's repository, create a malicious GitHub Actions workflow, and push it to the repository. This allows an attacker to execute arbitrary code on future pushes to the repository, posing a significant security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall bfox-build-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the bfox-build-utils package until a patched version is released. Additionally, ensure that your GitHub credentials are not exposed in the environment variables or Git configuration.
Conclusion
The bfox-build-utils package has been compromised to include malicious code that poses a serious security threat by stealing GitHub credentials and injecting unauthorized workflows. Users are advised to uninstall the package and monitor their repositories for any unauthorized changes.
See every vulnerability recorded for bfox-build-utils →
FAQ
The vulnerability involves malicious code that steals GitHub credentials and injects unauthorized workflows into the installer's repository.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Uninstall the package immediately and check for any unauthorized changes in your GitHub repository.
Check the official PyPI page for bfox-build-utils for any updates or patched versions.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock, providing an efficient way to manage security.
