pypi / gist-backup

gist-backup 0.1.2

Riskmedium Vulnsnone

processes: 737
operations: 24K
packages: 10
compiler runs: 3
connections: 2
job time: 38s
capture: 193 KB
records: 38K
bytes / record: 5.1

Back up a local file to a GitHub Gist

published 2026-06-18 · source · home page backup cli gist github View on PyPI Release

Behaviorsmalicious

Graph

egress · medium

Checks

18 of 19 clear Network activity

Build behavior▲✓✓✓✓✓✓✓✓✓✓

Supply chain✓✓✓✓✓✓✓

Pipeline✓

Detections

Package code dialled an undeclared host, and nothing answered

10.201.0.1:18080 › 10.201.0.1:18080, pypi.org

medium

Network

2 peers

files.pythonhosted.org:8080 the package manager · python3.14 (gist-backup) via pypi.org ecosystem
10.201.0.1:18080 gist-backup's own build code · gist-backup; python3.14 (gist-backup) unjudged

Dependencies10	Build behavior
build1.6.1
packaging26.3
pyproject-hooks1.3.3
hatchling1.33.0
pathspec1.1.1
pip25.1.1
pip26.3
pluggy1.7.0
tomlkit0.15.2
trove-classifiers2026.9.21.13

Versions3

1 of 1 jobs captured: build-import success · Generated 2026-11-08 · run a88afae0-6087-4a99-9925-6b3a96e42b39

analysis 0.1.0 · 2026-11-07 · f047eed · graph v2

gist-backup uploads files through a hardcoded proxy and ships a GitHub token

Verdict: deny
Behaviors: malicious
Covers: 0.1.0, 0.1.1 and 0.1.2
Reviewed by: Bitbison
Updated: 2026-11-09

A backup CLI that sends ~/.bashrc to GitHub Gists through an undocumented hardcoded proxy (10.201.0.1:18080) and ships its own GitHub personal access token.

gist-backup is a Python package on PyPI that installs a gist-backup console command and describes itself as a way to back up a local file to a GitHub Gist. Published with no author or maintainer metadata and a declared homepage that does not resolve, it has been on PyPI since June 18, 2026 and is still served.

What gist-backup does

When invoked, gist-backup reads a local file and uploads it to the GitHub Gist API. The default file is the user's ~/.bashrc (backup.py:16). It takes a GitHub personal access token from the GITHUB_TOKEN environment variable and sends it in the Authorization: Bearer header of every request (backup.py:41-52, 72-101). It then lists the account's gists and creates or updates one with the file's contents (backup.py:112-137).

All of this traffic is forced through a hardcoded HTTP/HTTPS proxy at 10.201.0.1:18080 (backup.py:26, 31-39). The proxy is not mentioned in the README's configuration table, which documents the other constants. The source distribution also ships key.txt, containing a GitHub personal access token for the project's own account.

What the code does

backup.py:16 — BACKUP_FILE defaults to ~/.bashrc, a file that commonly holds shell secrets.
backup.py:26 — PROXY is hardcoded to 10.201.0.1:18080.
backup.py:31-39 — _build_opener() installs a ProxyHandler for both http and https, so every GitHub API request goes through that proxy.
backup.py:41-52 — _github_token() reads GITHUB_TOKEN from the environment.
backup.py:72-101 — _api_request() sends requests with the bearer token through the proxy opener.
backup.py:112-137 — backup() assembles a payload containing the file's content and creates or patches a Gist.
key.txt:1 — a GitHub personal access token shipped in the source distribution; no code references it, so it is a leaked credential rather than a configuration value.
test_backup.py:45 — the author's own test asserts the ProxyHandler is present when PROXY is the hardcoded address, confirming the proxy is deliberate.

Timeline (UTC)

When	What
2026-06-18 12:59	0.1.0 published, with the `10.201.0.1:18080` proxy hardcoded
2026-06-18 15:17	0.1.1 published, proxy disabled and `key.txt` (a GitHub token) added
2026-06-18 15:22	0.1.2 published, proxy re-enabled, `key.txt` retained
2026-11-09	Still served on PyPI, about four and a half months after first publication

If you installed it

Uninstall gist-backup. If you ran it with GITHUB_TOKEN set, revoke that token, since the tool sends it with every request. Treat the contents of any file it was pointed at (by default ~/.bashrc) as having left the machine, and rotate any secrets those files contain. Do not use the token shipped in key.txt.

Indicators

hosts: 10.201.0.1:18080
files: key.txt
processes

What was examined

0.1.0: sha256:056de202f3c7101a87da935c69be936c238fe9e64318c9171dba5fa4e0c3f3a6
0.1.1: sha256:0dd0acd3f2dfe1ccd21d74328b59d56ac43235dbf02882a7a3eafe70b3ede4b4
0.1.2: sha256:33c43f9a04fef42910081512c2a0541605be7505d1edf0c7cc7ca18201cee6a8