Supply chain · pip · High

Critical Malicious pip Package: dedh-devops-automation Steals Credentials

Threat Engine Auto-Feed · data current as of 2026-10-02

A critical malicious package, `dedh-devops-automation` (version 0.0.1) in the pip ecosystem, has been identified. During installation, it deploys a rogue AWS Lambda function to collect and exfiltrate credentials from Secret Manager and other data. Organizations using this package are at high risk of credential theft and data exfiltration.

  • Package: pip / dedh-devops-automation
  • Affected versions: = 0.0.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The `dedh-devops-automation` package (version 0.0.1) was found to contain malicious code. Upon installation, it executes commands to deploy an unauthorized AWS Lambda function. This function is designed to collect credentials from AWS Secret Manager and other sensitive data, subsequently exfiltrating them.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a public repository. When a developer or automated system installs the package, the embedded malicious code executes during the installation process. This code then establishes a persistent mechanism (like a rogue cloud function) to gather and transmit sensitive information, such as cloud credentials, to an attacker-controlled destination.

Who's exposed

Profiles most at risk

  • Development teams using the pip ecosystem for Python projects
  • CI/CD pipelines that automatically pull and install Python packages
  • Organizations with AWS environments where this package might be installed

Conditions that increase exposure

  • Unpinned dependencies allowing installation of the latest (malicious) version
  • Lack of dependency lockfiles (e.g., `requirements.txt` with exact versions)
  • Use of internal package mirrors that do not vet upstream packages
  • Environments with broad AWS IAM permissions for build/deployment processes

Blast-radius scenarios

  • Credential theft from AWS Secret Manager, leading to unauthorized access to cloud resources.
  • Exfiltration of other sensitive data from the compromised environment.
  • Potential for further lateral movement within the AWS environment using stolen credentials.
  • Compromise of development or production systems where the package was installed.

What to do (defensive)

Detect

  • Scan dependency trees for `dedh-devops-automation` version 0.0.1.
  • Monitor AWS CloudTrail logs for unexpected Lambda function deployments or modifications.
  • Review AWS Secret Manager access logs for unusual access patterns.
  • Implement software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately quarantine any systems or environments found to have installed `dedh-devops-automation` version 0.0.1.
  • Revoke AWS credentials associated with any compromised systems or deployment pipelines.
  • Isolate network segments where the package may have been installed to prevent further exfiltration or lateral movement.
  • Block `dedh-devops-automation` version 0.0.1 from being pulled by package managers or internal mirrors.

Remediate

  • Remove `dedh-devops-automation` version 0.0.1 from all affected environments and dependency lists.
  • Rotate all AWS credentials that could have been exposed, especially those used by Secret Manager or deployment processes.
  • Audit AWS environments for any unauthorized Lambda functions or resource deployments.
  • Enforce strict dependency version pinning and review all new package additions.

Frontier verdict — High

Prioritize immediate detection and removal of `dedh-devops-automation` due to critical credential theft risk and potential AWS environment compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.