gist-backup 0.1.2

gist-backup is a Python package on PyPI that installs a gist-backup console command and describes itself as a way to back up a local file to a GitHub Gist. Published with no author or maintainer metadata and a declared homepage that does not resolve, it has been on PyPI since June 18, 2026 and is still served.

What gist-backup does

When invoked, gist-backup reads a local file and uploads it to the GitHub Gist API. The default file is the user's ~/.bashrc (backup.py:16). It takes a GitHub personal access token from the GITHUB_TOKEN environment variable and sends it in the Authorization: Bearer header of every request (backup.py:41-52, 72-101). It then lists the account's gists and creates or updates one with the file's contents (backup.py:112-137).

All of this traffic is forced through a hardcoded HTTP/HTTPS proxy at 10.201.0.1:18080 (backup.py:26, 31-39). The proxy is not mentioned in the README's configuration table, which documents the other constants. The source distribution also ships key.txt, containing a GitHub personal access token for the project's own account.

What the code does

• backup.py:16 — BACKUP_FILE defaults to ~/.bashrc, a file that commonly holds shell secrets.
• backup.py:26 — PROXY is hardcoded to 10.201.0.1:18080.
• backup.py:31-39 — _build_opener() installs a ProxyHandler for both http and https, so every GitHub API request goes through that proxy.
• backup.py:41-52 — _github_token() reads GITHUB_TOKEN from the environment.
• backup.py:72-101 — _api_request() sends requests with the bearer token through the proxy opener.
• backup.py:112-137 — backup() assembles a payload containing the file's content and creates or patches a Gist.
• key.txt:1 — a GitHub personal access token shipped in the source distribution; no code references it, so it is a leaked credential rather than a configuration value.
• test_backup.py:45 — the author's own test asserts the ProxyHandler is present when PROXY is the hardcoded address, confirming the proxy is deliberate.

Timeline (UTC)

If you installed it

Uninstall gist-backup. If you ran it with GITHUB_TOKEN set, revoke that token, since the tool sends it with every request. Treat the contents of any file it was pointed at (by default ~/.bashrc) as having left the machine, and rotate any secrets those files contain. Do not use the token shipped in key.txt.