infra-libs

{"schema_version":"1.7.4","id":"MAL-2026-18761","published":"2026-11-08T09:39:28Z","modified":"2026-11-08T14:12:22.378022539Z","summary":"Malicious code in infra-libs (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32)\ninfra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form `install-<random-id>-<hostname>` and calls socket.getaddrinfo against `<label>.testa213022.dssldrf.net`, causing the authoritative name server for that zone to receive the installer's platform.node() value during `pip install`. gcp_log_poc/__init__.py repeats the same pattern with an `import-<id>-<hostname>` label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name `infra-libs` is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.\n\n## Source: kam193 (2796ca84a4fd5c8e195f4b1a5cd7ce752c3a13c34e015ea1ce0436a2774c3b8d)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"infra-libs","ecosystem":"PyPI"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["infra_libs-99.99.99.tar.gz"],"path":"setup.py","sha256":"9c2886417255e482c684ceef00c8a98f98317958b871b4f183628084e7a4a737","tlsh":"cae06a03d7339d83745115c504f930615f3e19177f31648d774503126f9f05a4437607"},{"artifacts":["infra_libs-99.99.99.tar.gz","infra_libs-99.99.99-py3-none-any.whl"],"path":"gcp_log_poc/__init__.py","sha256":"4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e","tlsh":"0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"}],"package_integrity":[{"filename":"infra_libs-99.99.99-py3-none-any.whl","hashes":{"blake2b_256":"05784fc8901dffe84a3fe2c4f83cbfe929465577818eb26d0757b00f54ddb7b1","md5":"2d0ef9f1cc87477fb789342fffca90d0","sha256":"25ed0efc14f32835fa43902737c17cfebd49ce2ffa9a32d9a139fde275e92b78"}},{"filename":"infra_libs-99.99.99.tar.gz","hashes":{"blake2b_256":"1bcc02a24eb9211a845ef55dcc871e24cfe71c92babb82aa01dcd114afb158c3","md5":"fc81dacf2fd7c110ccea0d12fee32917","sha256":"a06af23885f3d7497b25c890f5308c370d609a4cae1e28aeca1c585e056b7105"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/infra-libs/99.99.99/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/infra-libs"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022565","import_time":"2026-11-08T10:11:08.930000061Z","modified_time":"2026-11-08T09:39:28Z","sha256":"721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32","source":"amazon-inspector","versions":["99.99.99"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/infra-libs","import_time":"2026-11-08T14:10:37.568355246Z","modified_time":"2026-11-08T13:51:24.678792Z","sha256":"2796ca84a4fd5c8e195f4b1a5cd7ce752c3a13c34e015ea1ce0436a2774c3b8d","source":"kam193","versions":["99.99.99"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}