parseyaml

Source: amazon-inspector (42b56cbea8e7b46f2ad7dc1d59334a45862f50366944ee198e97c68a313681ef)
parseyaml 1.2.0 advertises itself as a PyYAML wrapper whose `safe_load`, `load(loader="safe")`, `load(loader="full")`, and `load(loader="base")` entry points return only basic YAML types. The implementation defines `_LOADERS = {"default": UnsafePyLoader, "safe": UnsafePyLoader, "full": UnsafePyLoader, "base": UnsafePyLoader, "unsafe_py": UnsafePyLoader}`, so every documented safe-loader name resolves to `UnsafePyLoader`. `UnsafePyLoader` registers a `!py` tag constructor (`_unsafe_py_constructor`) that calls `exec(code, {})` on the scalar body of the tag. Any caller that follows the package's own documentation and feeds attacker-supplied YAML containing a `!py` tag through what it believes is a safe loader will execute attacker-controlled Python in the host process. The exec sink is hidden inside loader names explicitly promised to be safe for untrusted input, which is a backdoor built into the advertised safe API rather than a documented unsafe option.

Source: kam193 (21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3)
In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-parseyaml

Reasons (based on the campaign):

- The malicious code is intentionally included in a dependency of the package

- Downloads and executes a remote malicious script.