GitHub Advisoryadvisory · PyPI

GHSA-x6xg-3fj2-4pq3 `exotel` project on PyPI compromised, malicious release made

HIGH Published 2024-08-30 Modified 2024-08-30 Official page ↗
Ecosystem
PyPI
Packages
exotel
Severity
High
Reviewed
2024-08-30

Affected packages

• PyPI exotel: 0.1.6 (no fix yet)

Description

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time

References