Malicious Code Vulnerability in fwk-amigapython: Exfiltration and Remote Command Execution
Summary
MAL-2026-1137: Malicious code in fwk-amigapython (PyPI). Affects fwk-amigapython versions 2.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fwk-amigapython is a Python package available on PyPI that is designed for specific functionalities related to the Amiga platform. However, it has been compromised, leading to a serious security vulnerability that allows malicious actors to exfiltrate sensitive data and execute remote commands on affected systems.
Vulnerability Detail
The vulnerability originates from a malicious module that is imported under certain conditions. This module masquerades as telemetry code but is designed to exfiltrate sensitive environment variables and cloud tokens to a hardcoded external location. Additionally, it initiates a job that listens for commands to execute on the victim's machine. This poses significant risks, including data breaches and unauthorized access to systems, and is indicative of dependency confusion attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fwk-amigapythonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the fwk-amigapython package until the vulnerability is fully addressed. Additionally, consider using environment variable management tools to limit exposure of sensitive data.
Conclusion
The fwk-amigapython package has been compromised with malicious code that exfiltrates sensitive data and allows for remote command execution. It is crucial to update the package to the latest version to mitigate these risks and to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for fwk-amigapython →
FAQ
fwk-amigapython is a Python package designed for functionalities related to the Amiga platform, but it has been compromised with malicious code.
The malicious code exfiltrates sensitive environment variables and cloud tokens, which can lead to unauthorized access to cloud services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include data breaches, unauthorized access to sensitive information, and potential remote command execution on affected systems.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
