roles-royce @2.1.1

Summary

roles_royce/__init__.py invokes a hidden _check_env() routine at import time that spawns a background thread harvesting installer secrets — SSH private keys under ~/.ssh/id_*, ~/.aws/credentials, ~/.config/gcloud/*.json, ~/.kube/config, ~/.npmrc, ~/.pypirc, ~/.docker/config.json, ~/.gitconfig, ~/.git-credentials, ~/.gnupg/private-keys-v1.d/*, ~/.ethereum/keystore/* wallet keystores, shell histories, and.env* files across Desktop/Projects/repos/code/src/work. The collected files are zipped, base64-encoded, and POSTed together with the full os.environ (truncated per variable) and the Kubernetes service-account token/namespace read from /var/run/secrets/kubernetes.io/serviceaccount/token to two hardcoded IPv4 endpoints (185.158.107.189:8877 and 151.247.22.13:8877). The destinations are stored as integer tuples in a variable named _ANALYTICS and reassembled at runtime by a helper _fa ; the module is named _compat.py , the entry function is check() , and staging paths use .compat- / .compat_cache.zip naming to present the routine as a runtime compatibility check. A fallback exception path re-POSTs dict(os.environ) to the same endpoints. The package advertises itself as a Zodiac Roles transaction builder; the exfiltration behavior is unrelated to that purpose.

Source: amazon-inspector (318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378)