Malicious code in spo365-graph (PyPI)

{
  "id": "bf9c39bc20fd951bfefe32f6d6c6dea881b23f77a7aaea343d44b259d5cb3695",
  "url": "https://osv.dev/vulnerability/MAL-2026-17421",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in spo365-graph (PyPI)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b) SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365_GRAPH/SPO365_GRAPH.py consists entirely of stub methods returning placeholder values; all real logic lives in setup.py and executes at install time. On `pip install`, setup.py decodes a zlib+base64 blob (_SERVICE_CONFIG) into a configuration dict holding an AWS STS endpoint, a hardcoded RoleArn, an RSA public key, upload/webhook URLs, a proxy host, and an embedded Lambda source. It then reads ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN from the environment, requests a GitHub Actions OIDC JWT with audience sts.amazonaws.com, and calls STS AssumeRoleWithWebIdentity against the attacker's hardcoded RoleArn to obtain temporary credentials under the attacker's trust policy. Using those credentials it submits a CloudFormation CreateStack request whose TemplateBody embeds an AWS::Lambda::Function with Code.ZipFile sourced from the obfuscated config (_cfg['vs']) and a hardcoded role/function name, polls DescribeStacks for Outputs, then base64-decodes the collected outputs, wraps them with hybrid RSA-OAEP + AES-256-CBC using the embedded public key, and uploads the ciphertext via PUT to _cfg['ru'] with a POST fallback to _cfg['fu'], optionally through a hardcoded HTTP proxy at _cfg['px']. Author metadata is a d",
    "evidence": "osv:MAL-2026-17421",
    "products": [
      {
        "name": {
          "value": "spo365-graph",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.2",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17421",
      "aliases": [
        "MAL-2026-17421"
      ],
      "affected": [
        {
          "package": {
            "name": "spo365-graph",
            "purl": "pkg:pypi/spo365-graph",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.0.0",
            "1.1.0",
            "1.1.1",
            "1.1.2"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spo365-graph/MAL-2026-17421.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "setup.py",
                  "tlsh": "1282c89ad9986ce3c74b846a88d78551b33a790b340528387eac539c1f8cd7dd3b729c",
                  "sha256": "ed2469abf06d19196b03a57344881b9df243a77cc8471d136149ac53f5eafca6"
                },
                {
                  "path": "SPO365_GRAPH/SPO365_GRAPH.py",
                  "tlsh": "f351204bd5521dd3e25ace33b3a6ec403615965f4443352c7deca0cc1f1182d9aeaac6",
                  "sha256": "1880d732fd191f07399729990017f332ad311ad2e7227933b84742fcc3c54547"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "967a63273068104ac04af88367fa74b4",
                    "sha256": "7acebd82867d0cbd20b951a1e4dd383935116b99c29959853fdded797cd5042d",
                    "blake2b_256": "b6b83ff1e471cf3911711d530fa6eced94c554b4515fb72a311a971eb1f84773"
                  },
                  "filename": "spo365_graph-1.1.2.tar.gz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T20:30:04.745549763Z",
      "provider": "osv",
      "references": [
        "https://bad-packages.kam193.eu/pypi/package/spo365-graph",
        "https://pypi.org/project/SPO365-GRAPH/1.1.2/"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "pypi/2026-10-spo365-graph/spo365-graph",
            "sha256": "ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1",
            "source": "kam193",
            "versions": [
              "1.0.0",
              "1.1.0",
              "1.1.1",
              "1.1.2"
            ],
            "import_time": "2026-10-01T19:40:24.541905041Z",
            "modified_time": "2026-10-01T18:58:14.816166Z"
          },
          {
            "id": "pypi/2026-10-spo365-graph/spo365-graph",
            "sha256": "5fef22ae28edcff38a319610223e2d0691c92bf11e472adfa5c6d892d62bc77f",
            "source": "kam193",
            "versions": [
              "1.0.0",
              "1.1.0",
              "1.1.1",
              "1.1.2"
            ],
            "import_time": "2026-10-02T14:21:00.466042478Z",
            "modified_time": "2026-10-01T18:58:14.816166Z"
          },
          {
            "id": "pypi/2026-10-spo365-graph/spo365-graph",
            "sha256": "7c7ffd80d861a96fdf27359d7bc4003cdffc862ddbff6ec08ac433bb8d94eea2",
            "source": "kam193",
            "versions": [
              "1.0.0",
              "1.1.0",
              "1.1.1",
              "1.1.2"
            ],
            "import_time": "2026-10-02T15:19:27.463736704Z",
            "modified_time": "2026-10-01T18:58:14.816166Z"
          },
          {
            "id": "IN-MAL-2026-021232",
            "sha256": "091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b",
            "source": "amazon-inspector",
            "versions": [
              "1.1.2"
            ],
            "import_time": "2026-10-08T20:20:20.308907984Z",
            "modified_time": "2026-10-08T20:02:15Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 104578,
  "published_at": "2026-10-01T18:58:14+00:00"
}