1. The blast radius appears to be very minimal, the affected github package has 0 stars, 2 contributers, 1 watcher and 4 issues total.
2. The issue was caught and resolved quickly (within a day?).
3. I haven't seen any explanation by the developer on whether there account was compromised?
The vulnerability is not in FastAPI itself, but in a relatively unknown utility package that you probably aren't using.
Still good to raise awareness but a slight bit of scaremongering
It's not scaremongering as much as it is a (thinly veiled) ad for Datadog's own tech:
> using our latest open source tool, GuardDog, which uses heuristics to identify malicious or compromised PyPI packages.
> We recently released GuardDog, a free and open-source tool to identify malicious PyPI packages
> Datadog ASM Vulnerability Monitoring, announced earlier this year at Dash, allows you to identify vulnerable and malicious packages
> Datadog Cloud Workload Security has a number of out-of-the-box rules to detect post exploitation scenarios
> While FastAPI itself is not impacted, this is an interesting occurrence of an attacker attempting to deploy a FastAPI-specific backdoor.
Appreciate your feedback!
I know they are public via GH, but it feels weird to redact every piece of PII including avatar, then leaving a name and email in there.