qzc690382

{"schema_version":"1.7.4","id":"MAL-2026-18749","published":"2026-11-07T10:21:14Z","modified":"2026-11-07T15:11:48.059025888Z","summary":"Malicious code in qzc690382 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e)\nThe package body is inert (`__init__.py` contains only `#c\\n`); the entire functionality lives in setup.py, which runs on `pip install`. During install, setup.py writes a Python HTTP server script to `/tmp/.kxs` and launches it detached via `subprocess.Popen([sys.executable, '/tmp/.kxs'], start_new_session=True)`. The server binds `0.0.0.0` on ports 9998, 9999, 8089, 8099, and 8899 and executes any shell command passed in a GET `c=` query parameter via `subprocess.run(c, shell=True,...)`, gated only by a token stored at `/tmp/.kxq`. The result is a persistent, network-exposed shell on all interfaces of the installing machine, running as the installing user, with no relationship to building or using any advertised functionality.\n\n## Source: kam193 (dbcf75de5bd0a526e2aad408ec7999bd29b6648a527662b01405279824f7939a)\nIn this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-qzc\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - backdoor\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"qzc690382","ecosystem":"PyPI"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["qzc690382-1.0.0.tar.gz"],"path":"setup.py","sha256":"6c61e1033d7964b18acdd94bf1e20f930b67ffbd791fd657696f91efd890552e","tlsh":"27416205dc42111697c39ee74422d8622bbe7893f60a887d339e86612fce430c5fa9fd"}],"package_integrity":[{"filename":"qzc690382-1.0.0.tar.gz","hashes":{"blake2b_256":"e813dcf8201d16324affbd54e3ecc35ece305f463b9df439b249c3b5ede56889","md5":"d2002c5b7346d040c679c1311b8db494","sha256":"1d06344b7c5cba3d112c71f6fdc5ab43babafa1051ba34546fde08e516fc2a60"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/qzc690382/1.0.0/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/qzc690382"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022544","import_time":"2026-11-07T10:36:42.60566658Z","modified_time":"2026-11-07T10:21:14Z","sha256":"b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e","source":"amazon-inspector","versions":["1.0.0"]},{"id":"pypi/2026-11-qzc/qzc690382","import_time":"2026-11-07T15:10:15.54894795Z","modified_time":"2026-11-07T14:44:29.474478Z","sha256":"dbcf75de5bd0a526e2aad408ec7999bd29b6648a527662b01405279824f7939a","source":"kam193","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}