qzc690385

{"schema_version":"1.7.4","id":"MAL-2026-18751","published":"2026-11-07T10:21:05Z","modified":"2026-11-07T20:38:29.181377334Z","summary":"Malicious code in qzc690385 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb)\nAt install time, setup.py polls the local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, selects model registrations whose names begin with 'xcmd0', url-safe-base64-decodes the suffix into a shell command, and runs it via subprocess.run(['/bin/sh', '-c',...]). The stdout/stderr of each execution is chunked, base64-encoded, and written back as new model registrations named 'zqx9p00<out>', 'zqx9p01<out>', 'zqx9err', with a 'zqx9alive' registration used as a liveness beacon. The command bytes are obfuscated as the url-safe-base64 suffix of a model name (reassembled by replacing '-'/'_' and padding '=' before base64 decode), so the payload only materializes after decode. The package has no declared purpose, an empty PKG-INFO, and a random-looking name, and ships no legitimate functionality. The effect is a bidirectional command-execution and output-exfiltration channel driven at pip install time: any party able to post model registrations to the installer's Xinference service (locally, or via SSRF/misconfiguration of that service) can run arbitrary shell commands on the installer's host as the installing user and read the results back through the same registry.\n\n## Source: kam193 (38936057b5c5ae57efbe9fc39bb036a1c848141352548997ae9ddb9d54737468)\nIn this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-qzc\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - backdoor\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"qzc690385","ecosystem":"PyPI"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["qzc690385-1.0.0.tar.gz"],"path":"setup.py","sha256":"d2b9c88e30eefcae8d13c3fbc9f7fbba3b597f4809c3b12acea77f564b87282e","tlsh":"4571a341e8115967db87ccb840a0e8622b9e6a4fa107647933bd43661fcc439c6b56fd"}],"package_integrity":[{"filename":"qzc690385-1.0.0.tar.gz","hashes":{"blake2b_256":"d89988040c162ba45c2ba9fa502853198c50f044c56289b4c55252d83943f985","md5":"2999895313a23863cd0a3ee7269506ab","sha256":"d94e0d5acdff4d40b504f49a9c258e070201bf4e077e5d674eda702216b2cc08"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.1/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/qzc690385"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.1.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.8/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.6/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.9/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.5/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.1.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.7/"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022543","import_time":"2026-11-07T10:36:42.4789447Z","modified_time":"2026-11-07T10:21:05Z","sha256":"84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-022545","import_time":"2026-11-07T10:36:42.670969727Z","modified_time":"2026-11-07T10:21:20Z","sha256":"8fdb508a0701cb28bc4c5613c93d04d825da018b4b1318ed50a53672cb33e1bc","source":"amazon-inspector","versions":["1.0.1"]},{"id":"pypi/2026-11-qzc/qzc690385","import_time":"2026-11-07T15:10:15.5525287Z","modified_time":"2026-11-07T14:42:00.030569Z","sha256":"38936057b5c5ae57efbe9fc39bb036a1c848141352548997ae9ddb9d54737468","source":"kam193","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.1.3"]},{"id":"IN-MAL-2026-022553","import_time":"2026-11-07T20:36:36.696593549Z","modified_time":"2026-11-07T20:17:33Z","sha256":"9e7cea30fe3b1852ec4ed833d3ad2ba466bdbc812bef71f984e433017bd0044c","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-022555","import_time":"2026-11-07T20:36:36.82123902Z","modified_time":"2026-11-07T20:17:46Z","sha256":"28f5ce815f3d6529385dfd196d0b0d88f8b5b35c4e6311a627d14d48e3087dc7","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-022550","import_time":"2026-11-07T20:36:36.532309905Z","modified_time":"2026-11-07T20:17:12Z","sha256":"4f83452b8f5689bce9944fdd53f53a111df02f4415ac76e2d1f924ec6c695be2","source":"amazon-inspector","versions":["1.1.1"]},{"id":"IN-MAL-2026-022548","import_time":"2026-11-07T20:36:36.404553025Z","modified_time":"2026-11-07T20:16:56Z","sha256":"769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb","source":"amazon-inspector","versions":["1.0.8"]},{"id":"IN-MAL-2026-022554","import_time":"2026-11-07T20:36:36.750018046Z","modified_time":"2026-11-07T20:17:40Z","sha256":"c140ddb16b3010e95b7cd6a5283ebeb396788619d6c05a1b182f4d7c58d14b0b","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-022552","import_time":"2026-11-07T20:36:36.646398655Z","modified_time":"2026-11-07T20:17:26Z","sha256":"c84f2c4bdfe6ef8f3702be8282a050f2d8deee0ca079552175ad0f8d739fcfde","source":"amazon-inspector","versions":["1.0.9"]},{"id":"IN-MAL-2026-022557","import_time":"2026-11-07T20:36:36.947587803Z","modified_time":"2026-11-07T20:18:01Z","sha256":"2695339afa450d24b1d27daf6cbea4e17c12f8968bfd22b65d9308e47ac607fc","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-022551","import_time":"2026-11-07T20:36:36.59573241Z","modified_time":"2026-11-07T20:17:19Z","sha256":"2ce9b59b878d5e873c8270d9a988097b87c56cb2cd2c25f956deec2cd66c98d2","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-022549","import_time":"2026-11-07T20:36:36.485260591Z","modified_time":"2026-11-07T20:17:04Z","sha256":"6385ebf21c2ba4f27313c2b478821c42ef0a4ae99d70aa04c4313039e2b52fcd","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-022547","import_time":"2026-11-07T20:36:36.34320596Z","modified_time":"2026-11-07T20:16:48Z","sha256":"69d0a61f0c5e4cac02d592cc7882a0eac8d95f78cbee7fd341fdf63ffe78b2b4","source":"amazon-inspector","versions":["1.0.7"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}