
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
This tool assists you in using fleetctl
to control a remote CoreOS cluster. Doing so requires an IP address to one of the nodes on the Cluster. Rather than logging in to AWS and finding that IP manually (which would have to happen everytime, as the IP could change, especialy if you're using the recommended CloudFormation approach with an Auto-Scaling Group), this tool helps by picking a node in a cluster which you specify by a search term.
At the moment, it only uses the Search term for finding a CloudFormation stack based on its stack_name
. It should be rather trivial to expand the search to other services.
$ gem install fleetctl-setup
It uses the aws-core-api
gem to talk to AWS. This requires authentication with
IAM credentials, and a region, to be configured.
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_REGION=us-east-1
Then, run fleetctl-setup [search]
.
Assuming you have a CloudFormation stack called 'internal-tools', a search for "tools" may result in this:
$ fleetctl-setup tools
Looking up instances for CloudFormation Stack: internal-tools
Picking randomly from <ip_addr1>, <ip_addr2>, <ip_addr3>, <ip_addr4>.
export FLEETCTL_TUNNEL=<ip_addr3>
The last line is the variable you need to set in your shell to use fleetctl
.
All the output of this tool is on STDERR, save for that last line, so you can eval the output for easier use:
$ eval `fleetctl-setup tools`
Looking up instances for CloudFormation Stack: internal-tools
Picking randomly from <ip_addr1>, <ip_addr2>, <ip_addr3>, <ip_addr4>.
$ echo $FLEETCTL_TUNNEL
<ip_addr4>
$ fleetctl list-machines
MACHINE IP METADATA
3f5399cd... <ip_addr1> -
b7ff2469... <ip_addr2> -
cd411b1d... <ip_addr3> -
aa07c493... <ip_addr4> -
If you use an ambiguous search term, it will prompt you to choose among the results, before it grabs any info about instances.
To get fleetctl
installed on your system, refer to the following resources:
FAQs
Unknown package
We found that fleetctl-setup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.