For around 6 hours today, the Pypi package exotel had a malicious release, 0.1.6 published. It's setup.py would, on install, run a post-install hook, and call back to a C2 server.
The malicious version was pulled by PyPi some minutes ago and is no longer installable. The library seems unmaintained since its last release 0.1.5 in 2017. Just in case - pin version to last known good - 0.1.5.
Informational advisory.
For around 6 hours today, the Pypi package exotel had a malicious release,
0.1.6published. It'ssetup.pywould, on install, run a post-install hook, and call back to a C2 server.If you installed
Yelp/elastalertduring this time window, you might be affected. There is a loose version constraint toexotelpackage inrequirements.txt: https://github.com/Yelp/elastalert/blob/master/requirements.txt#L10The malicious version was pulled by PyPi some minutes ago and is no longer installable. The library seems unmaintained since its last release
0.1.5in 2017. Just in case - pin version to last known good -0.1.5.Ref https://github.com/jertel/elastalert2/pull/931 & https://github.com/sarathsp06/exotel-py/issues/10
(this is a backport of the hotfix from jertel/elastalert2, and not strictly needed to apply, as impact time window has passed )