epic-build-scripts

{"modified":"2026-07-08T17:03:30Z","published":"2026-07-02T21:23:22Z","schema_version":"1.7.4","id":"MAL-2026-6733","summary":"Malicious code in epic-build-scripts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (14d466b50466bb93e6e9130d18e67b680c7255beecafe16043dc5ee51bfec886)\nOn `import epic_build_scripts`, the package's top-level __init__ spawns a background thread that POSTs a JSON payload containing socket.gethostname(), the USER/USERNAME environment variable, and os.getcwd() to the hardcoded bare-IP HTTP endpoint http://109.123.247.172/pypi. The beacon fires automatically whenever the module is loaded, with no user consent, no documented purpose, no configurability, and errors are silently swallowed. The destination is a plaintext-HTTP bare IP unrelated to any publisher infrastructure, and the collected fields are installer host-identity reconnaissance data typical of the initial-recon stage of a supply-chain attack.\n\n## Source: kam193 (93043b3f00a64c66fb0680256387471b656f222556c282c9cb1680347f14fae8)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"ecosystem":"PyPI","name":"epic-build-scripts"},"versions":["99999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"epic_build_scripts/__init__.py","sha256":"7b29694a047786777ed86573566df2c6bbf02ebfbbe93e6b56b97198f4bac90f","tlsh":"c101acd2ec385982524b314888254b742237b4172e02b8b47d8c9f3c0fcc56a42b46b8"}],"package_integrity":[{"filename":"epic_build_scripts-99999.0.0.tar.gz","hashes":{"blake2b_256":"dcb0713b424c5264b4769a70217be429163e4d117217c60b6b537e7db1cb0839","md5":"7eca6c44365b7db92d6ed3572e8377fd","sha256":"d45c9df86b8c0a4328274d2fa710dfd909aa9b52ed0abb5c0e8eee0e694e1430"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/epic-build-scripts"},{"type":"PACKAGE","url":"https://pypi.org/project/epic-build-scripts/99999.0.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"malicious-packages-origins":[{"source":"kam193","sha256":"93043b3f00a64c66fb0680256387471b656f222556c282c9cb1680347f14fae8","import_time":"2026-07-02T21:29:02.620098077Z","id":"pypi/GENERIC-standard-pypi-install-pentest/epic-build-scripts","modified_time":"2026-07-02T21:23:22.814482Z","versions":["99999.0.0"]},{"source":"amazon-inspector","sha256":"14d466b50466bb93e6e9130d18e67b680c7255beecafe16043dc5ee51bfec886","import_time":"2026-07-08T17:01:32.79050154Z","id":"IN-MAL-2026-008128","modified_time":"2026-07-08T16:28:49Z","versions":["99999.0.0"]}]}}