CVE-2022-38792

This is not a bug, it's a backdoor. The exotel package on PyPI, as of 0.1.6, was found to contain code-execution functionality deliberately inserted by a third party. Any project that installed that version pulled attacker-controlled code directly into its build and runtime, meaning the compromise happens at install time, before the application even runs.

Malicious packages are a different threat class from ordinary vulnerabilities: there is no exploit to launch because the payload is already resident wherever the package was installed. The realistic damage depends on where it landed, developer laptops, CI runners, production services, and a backdoor in a telephony integration library is well positioned to exfiltrate credentials or open a channel out. Removing it is necessary but not sufficient; the machines that ran it should be treated as touched.

This is squarely a dependency-hygiene and SBOM problem for us. We need to search build manifests and lockfiles across every Python project for exotel at the poisoned version, purge it, and then triage anything that installed it as a potential compromise, rotating secrets those environments held. A CVSS number is almost beside the point; the actionable fact is 'is this package present anywhere we build or run code.'