Vulnerabilities

Vulnerability · MAL-2026-17927

Malicious code in fabtoolkit (PyPI)

Published Oct 19, 2026 · catalog updated Oct 20, 2026 · Malicious code in fabtoolkit

Open the advisory

Exploitation likelihood is not on this record for MAL-2026-17927. A missing EPSS score is not a low risk. Compare Malicious code in fabtoolkit with the linked advisory before you change production.

Severity

Unknown—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Not established

Affected products

PyPI fabtoolkit

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d) fabtoolkit executes a payload (embedded as a CHILD string run via ) that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json with TLS verification disabled ( ) and dispatches on config-supplied values: reads arbitrary filesystem paths, executes attacker-supplied argv via subprocess, issues attacker-chosen requests with Bearer tokens chained from previously-read files, probes ports, and forks a daemon that polls and pipes the returned bytes into , PUTting stdout/stderr back to the same host. Collected file contents, command output, HTTP responses, and probe results are packed into an in-memory zip and PUT to transfer.archivete.am under an attacker-chosen report name. Before daemonizing, the payload walks and SIGKILLs processes whose cmdlines contain , , or , enforcing single-instance persistence and clearing prior variants. The entry points and any import path reaching / trigger the payload. The destination is an anonymous public file-transfer host; config-controlled file reads enable harvesting of credentials such as and along with cloud metadata via the kind. The package has no legitimate functionality matching its naming.