Malicious Code Injection in friendly-tools Package Exposes Sensitive Data
Summary
MAL-2026-17419: Malicious code in friendly-tools (PyPI). Affects friendly-tools versions 0.1 – 0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The friendly-tools package, available on PyPI, is marketed as a collection of small greeting utilities. However, it has been found to contain malicious code that compromises user data. This package is intended for Python developers looking for simple greeting functionalities but has been exploited to perform unauthorized actions against Snowflake databases.
Vulnerability Detail
The vulnerability originates from the inclusion of two gzip+base64 encoded blobs within the main.py file of the friendly-tools package. When the public API function run_demo() is invoked, these blobs are decoded and executed using Python's exec() function. The decoded code accesses the Snowflake OAuth session token from the filesystem, connects to the Snowflake database with elevated privileges (ACCOUNTADMIN), and exfiltrates sensitive data to an attacker-controlled S3 bucket. This malicious behavior is disguised under the guise of a greeting utility, making it a significant threat to users who may unknowingly execute the compromised code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall friendly-toolsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the run_demo() function from the friendly-tools package. Additionally, consider implementing strict access controls and monitoring for any unauthorized access to your Snowflake credentials.
Conclusion
The friendly-tools package has been identified as containing malicious code that can compromise sensitive data stored in Snowflake databases. Users are advised to uninstall the package immediately and monitor their systems for any unauthorized access. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source packages.
See every vulnerability recorded for friendly-tools →
FAQ
The friendly-tools package is a Python library that claims to provide small greeting utilities but has been found to contain malicious code.
The vulnerability allows malicious code to be executed via the run_demo() function, which can exfiltrate sensitive data from Snowflake databases.
Uninstall the friendly-tools package immediately and monitor your Snowflake account for any unauthorized access.
Yes, you can use Vulert to monitor and alert for vulnerabilities in your application. Visit Vulert Scanner to check if your application is affected without requiring signup.
Implement strict access controls, regularly monitor your accounts, and avoid using untrusted packages that may contain malicious code.
