{"items":[{"id":"NVI-00010897","kind":"supply_chain_event","title":"Malicious code in bfox-build-utils (PyPI)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rx43-29mc-6h3f"],"plain_summary":"GitHub lists this malware advisory for bfox-build-utils. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4611f3c226026dd249df64eecae2cb7b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4611f3c226026dd249df64eecae2cb7b","url":"https://github.com/advisories/GHSA-rx43-29mc-6h3f","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rx43-29mc-6h3f","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4611f3c226026dd249df64eecae2cb7b"],"technology":"bfox-build-utils","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293)\nAt install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads `$GITHUB_WORKSPACE/.git/config`, regexes the `extraheader = AUTHORIZATION: basic ` line that actions/checkout injects for the running job, base64-decodes it to recover the token, and also reads `GITHUB_TOKEN` from the environment. Using that token as `x-access-token`, it clones the installer's repository, creates branch `feature/ci-health-check`, writes `.github/workflows/ci-health-check.yml`, commits as `github-actions[bot]` with message `Add CI health check`, and pushes via git (with a REST-API fallback), explicitly bypassing the API restriction that protects workflow files. This plants a persistent, attacker-controlled GitHub Actions workflow in the installer's repository that will execute on future pushes to the planted branch. The shipped Python module `bfox_build_utils.py` is a two-line stub containing only `VERSION = \"1.0.997\"`; the package's advertised purpose (`Build utilities.`) and the innocuous naming of the branch, commit, and bot id","public_affected_ranges":["= 1.0.997"]}],"null_published_at":"2026-10-31T23:18:22.405Z","source_updated_at":"2026-09-30T03:31:46.000Z","source_disclosed_at":"2026-09-30T03:31:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"42594"}