Malicious Code Exfiltration in fwk-amigapython-rest-server Package
Summary
MAL-2026-1139: Malicious code in fwk-amigapython-rest-server (PyPI). Affects fwk-amigapython-rest-server versions 2.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fwk-amigapython-rest-server package is a Python library available on PyPI, designed to facilitate RESTful server interactions for applications. It is commonly used in various projects that require seamless communication between client and server. However, this package has been compromised, leading to significant security vulnerabilities that can expose sensitive information.
Vulnerability Detail
The vulnerability originates from a malicious code snippet that is imported under specific environmental conditions. This code masquerades as telemetry but is designed to exfiltrate sensitive environment variables and cloud tokens to a hardcoded external location. Additionally, it initiates a job that listens for remote commands to execute on the victim's machine. This poses severe risks, including unauthorized access to sensitive data and potential remote code execution.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fwk-amigapython-rest-serverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the fwk-amigapython-rest-server package until the vulnerability is patched. If you must use it, consider isolating the environment where it is deployed and monitoring for any suspicious activity.
Conclusion
The fwk-amigapython-rest-server package has been identified as containing malicious code that poses significant security risks. It is essential for users of this package to take immediate action by updating to the latest version or implementing workarounds to mitigate potential threats. Staying informed and utilizing tools like Vulert can enhance your security posture.
See every vulnerability recorded for fwk-amigapython-rest-server →
FAQ
It is a Python library designed for creating RESTful server interactions, commonly used in various applications.
The vulnerability can lead to the exfiltration of sensitive information and unauthorized remote command execution, compromising your application's security.
Immediately update the package to the latest version or consider removing it from your project until a fix is available.
You can refer to the official GitHub repository or security advisories related to the fwk-amigapython-rest-server package.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using your Pipfile.lock, allowing you to stay informed about potential risks without needing to access the code.
