If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (72282ce21daff38b5a1d6b1253b8ada1078d699ed0a28ab1d13a7a408560366d)
On a default `pip install bundyfed` on Windows, setup.py downloads a binary from https://www.dropbox.com/scl/fi/37vq644nu3rqfaq5xcf9j/BundyMultiExternal.exe, writes it to %APPDATA%\Microsoft\Windows\Caches\svchost.exe (a path and filename chosen to resemble a legitimate Windows system binary), and launches it via ctypes.windll.shell32.ShellExecuteW. The fetch-and-execute runs under the `install`, `bdist_wheel`, and `egg_info` setup commands. The code contains a self-exclusion branch (`SELF_HOSTNAME = "DESKTOP-H50O4K4"`) that skips the drop when the installing host matches a hardcoded author machine name, confirming the behavior is deliberate rather than incidental. Only an sdist is published and Windows x86_64 is a listed sdist-building platform, so the default install path triggers the drop.
Source: kam193 (81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de)
During installation, the package downloads a malicious executable holding an infostealer.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-bundyfed
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- The package overrides the install command in setup.py to execute malicious code during installation.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- veled[.]com[.]tr other packages →