The vulnerability is not in FastAPI itself, but in a relatively unknown utility package that you probably aren't using.
Still good to raise awareness but a slight bit of scaremongering
> While FastAPI itself is not impacted, this is an interesting occurrence of an attacker attempting to deploy a FastAPI-specific backdoor.
Appreciate your feedback!
I know they are public via GH, but it feels weird to redact every piece of PII including avatar, then leaving a name and email in there.
It's not scaremongering as much as it is a (thinly veiled) ad for Datadog's own tech:
> using our latest open source tool, GuardDog, which uses heuristics to identify malicious or compromised PyPI packages.
> We recently released GuardDog, a free and open-source tool to identify malicious PyPI packages
> Datadog ASM Vulnerability Monitoring, announced earlier this year at Dash, allows you to identify vulnerable and malicious packages
> Datadog Cloud Workload Security has a number of out-of-the-box rules to detect post exploitation scenarios