If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857)
The package's only public API, check(), spawns a Python child that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json using ssl._create_unverified_context() and dispatches handlers under remote control. A 'revsh' handler double-forks + setsid to daemonize, polls <base>/<id>-cmd.txt for commands, executes each fetched string via /bin/sh -c, and PUTs stdout/stderr back as <id>-out.txt — a full reverse-shell channel on the installer host. Additional handlers permit arbitrary file reads (kind='file' opens any path on disk), arbitrary process execution (kind='run' with attacker-supplied argv), TCP probing (kind='tcp'), and HTTP calls with Bearer tokens chained from previously-read files (kind='http'); collected results are zipped and PUT to the same anonymous file host under an attacker-chosen report name. Before launching the daemon the child walks /proc and SIGKILLs any process whose cmdline contains 'FABDRV3', 'fabdrv2', or 'connection ready' — housekeeping to replace prior implant generations and consistent with a self-named, iterated backdoor family. The control URL is anonymous, mutable, and reached with TLS verification disabled, so the operator of that path (or any MITM) obtains unauthenticated code execution on every host that invokes check().
Source: kam193 (3340a19275f536b55758d9924efaaf0307c746dec054b46fbdfac72b4d0e0a90)
Package hides code that starts malicious actions: it downloads a C2 configuration and executes commands from it. It supports exfiltrating files, running commands, and starting a reverse shell.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-fabtoolkit
Reasons (based on the campaign):
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- exfiltration-generic
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://transfer[.]archivete[.]am/H2Uxm/fabdeploycheck-config[.]json other packages →