Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

artifact-lab-3-package-3eef6c2cPyPI

Malicious code in artifact-lab-3-package-3eef6c2c (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2024-8051
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
pip uninstall artifact-lab-3-package-3eef6c2c

What this malware does

Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse?

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-08-lab-artifacts-revshell

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

The OpenSSF Package Analysis project identified 'artifact-lab-3-package-3eef6c2c' @ 0.2.0 (pypi) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

Malicious versions

2 flagged
0.2.00.3.0

Indicators of compromise (SHA-256)

a757e3e7e6ccbf2eb843b7fcb8938c8dd5e4d5daf874e48be2c3e29a2dbc4e45
bda4b3cfebe716b35deec05fd3ded743a5cb9cd4d55c26b3447473b661ee3670
2483831a74ac3f6a471558a15519b5895df179d3946b9291291a0f7fbeb0462a
2325acb67ca59e847fd003a5449350d2b0b12620ed80cb82cc6189f091bdacc7
1357091ac7cf3e2d7b6ae8c65e554ddf235c56dc4a45d99b34789c3fed287bc3

Detection & response playbook

Credential / info stealer

  1. Find it

    Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for artifact-lab-3-package-3eef6c2c (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging artifact-lab-3-package-3eef6c2c across your stack and pipelines.

  2. If you installed it — respond

    artifact-lab-3-package-3eef6c2c is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If artifact-lab-3-package-3eef6c2c was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

  4. How O3 protects you

    O3 blocks artifact-lab-3-package-3eef6c2c before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. artifact-lab-3-package-3eef6c2c on PyPI has been identified as a malicious package (versions 0.2.0, 0.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-109702024-08-lab-artifacts-revshell

References

Credits

  • Kamil Mańkowski (kam193)
  • OpenSSF: Package Analysis · finder
  • ReversingLabs · finder

Detect & block this

O3 blocks artifact-lab-3-package-3eef6c2c-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring