labelearthengine-api 0.0.5

labelearthengine-api is a Python package on PyPI that is a renamed copy of Google's earthengine-api Python client. It keeps the upstream client's author metadata, Google LLC and Google's Earth Engine homepage, but it is not published by Google, and its API endpoints are changed: it directs the library's authenticated Earth Engine requests to AWS infrastructure controlled by the publisher instead of to Google. Anyone who installs it and initializes it with Earth Engine credentials sends those credentials to a third party. Nothing in the package or its description says that requests go anywhere but Google. Its code comments and its routing of compute-heavy requests would also fit a relay for users who cannot reach Google directly; either way, the user's Google OAuth token reaches a third party without the package saying so.

What labelearthengine-api does

labelearthengine-api behaves like the Earth Engine Python client: it signs the user in through the normal Google OAuth flow (or application default credentials) and then calls Earth Engine services. Unlike the upstream client, it does not call Google's earthengine.googleapis.com endpoints for the Cloud API, tiles or map tiles. It calls three AWS endpoints instead: an API Gateway (5rvfq2luxa.execute-api.us-west-2.amazonaws.com) and two Lambda URLs (yiyl5zz2qjttytnjalvm3l65fq0dvndf.lambda-url.us-west-2.on.aws and 7zhqp23lqd4aafvyy63op6uoru0eeurw.lambda-url.us-west-2.on.aws). Each request carries the user's Earth Engine OAuth token, so the publisher's AWS endpoints receive it.

What the code does

The lines below are from 0.0.5. Every version since 0.0.0 does the same: 0.0.0 and 0.0.1 point the Cloud API at https://b7obz35kn0.execute-api.us-west-2.amazonaws.com/default and the tile and map-tile URLs at https://62dg4pnfmwt5bmbvh4neupdwhe0poelx.lambda-url.us-west-2.on.aws/default and https://iqiwcv35ask2zn2nshmrmmo4zq0kuenu.lambda-url.us-west-2.on.aws/default, and 0.0.2 onward use the three hosts named above. Google's own earthengine.googleapis.com addresses remain in le/data.py:131-132 but are not the ones the client uses.

• le/data.py:138 sets the Cloud API base URL to https://5rvfq2luxa.execute-api.us-west-2.amazonaws.com/default.
• le/data.py:135 sets the tile base URL to https://yiyl5zz2qjttytnjalvm3l65fq0dvndf.lambda-url.us-west-2.on.aws, and le/data.py:757 sets a map-tile URL to https://7zhqp23lqd4aafvyy63op6uoru0eeurw.lambda-url.us-west-2.on.aws.
• le/data.py:324-341 (_install_cloud_api_resource) constructs the API client against _cloud_api_base_url and passes _credentials to it.
• le/_cloud_api_utils.py:176-205 constructs the discovery service URL from that attacker-chosen api_base_url.
• le/_cloud_api_utils.py:183-189 wraps the HTTP transport in google_auth_httplib2.AuthorizedHttp(credentials, ...), which attaches the OAuth bearer token to every request.
• le/_cloud_api_utils.py:18-20 imports discovery/http/model from labelearthapiclient, the module provided by the dependency labelearth-api-python-client (pyproject.toml:42) rather than Google's google-api-python-client.

Timeline (UTC)

If you installed it

Uninstall it. If you initialized it or made any call with it, treat the Google credentials you used as compromised and revoke them: every authenticated request went to the publisher's AWS endpoints rather than to Google. Also remove the dependency labelearth-api-python-client if nothing else needs it.