GitHub Advisoryadvisory · PyPI
GHSA-x6xg-3fj2-4pq3 `exotel` project on PyPI compromised, malicious release made
HIGH
Official page ↗
- Ecosystem
- PyPI
- Packages
- exotel
- Severity
- High
- Reviewed
- 2024-08-30
Affected packages
• PyPI exotel: 0.1.6 (no fix yet)
Description
The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time