{"id":"MAL-2026-17180","summary":"Malicious code in my-private-pkg (PyPI)","details":"Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches my_private_pkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POST the resulting JSON to a hard-coded Webhook.site request collector. Dynamic analysis observed the wheel build spawn this script followed immediately by network activity. The package's public metadata describes it only as a private Python package and does not disclose the collection or transmission.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22)\nsetup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on `pip install`. That script gathers installer-side identifiers — os.getlogin(), socket.gethostname(), local IP address, os.getcwd(), platform.system() and platform.machine() — and POSTs them as JSON to a hardcoded collector URL at https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed. A duplicate of the exfiltration payload is shipped as vercel_runtime_python/index.py, and vercel_runtime_python/__init__.py contains the same PostInstallCommand wiring referencing my_private_pkg/index.py; the module name mimics Vercel's Python runtime. The package name and the internal vercel_runtime_python module name are consistent with a dependency-confusion lure targeting an internal `my-private-pkg` name and Vercel's runtime namespace: the only on-install effect is a reconnaissance beacon to an attacker-controlled webhook.site endpoint identifying the host that mistakenly resolved the public name.\n\n## Source: kam193 (b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2026-09-25T14:30:05.761879412Z","published":"2026-09-25T00:08:08Z","database_specific":{"malicious-packages-origins":[{"versions":["99.1.1"],"id":"IN-MAL-2026-020555","import_time":"2026-09-25T02:45:29.227169648Z","modified_time":"2026-09-25T02:42:27Z","sha256":"d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22","source":"amazon-inspector"},{"id":"pypi/GENERIC-standard-pypi-install-pentest/my-private-pkg","import_time":"2026-09-25T07:22:49.82314231Z","modified_time":"2026-09-25T06:04:29.410889Z","sha256":"b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b","source":"kam193","versions":["0.1.1","99.1.1","99.11.2"]},{"import_time":"2026-09-25T14:20:34.850642546Z","modified_time":"2026-09-25T14:11:24Z","sha256":"7bafbb2263df59c43341e43e30d2fc63739c60568f8b6814223fcbf4fa67259d","source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-020558"}],"iocs":{"urls":["https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed"],"domains":["webhook.site"]}},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/my-private-pkg/99.1.1/"},{"type":"EVIDENCE","url":"https://hyena-dashboard-314003657440.asia-northeast3.run.app/#/report/f6466201-aa5b-4136-b458-f88e7b9b4575?period=30&eco=all&tab=summary&return=%23%2Freports%3Fperiod%3D30%26eco%3Dall%26verdict%3Dmalicious"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/my-private-pkg"},{"type":"PACKAGE","url":"https://pypi.org/project/my-private-pkg/0.1.1/"}],"affected":[{"package":{"name":"my-private-pkg","ecosystem":"PyPI","purl":"pkg:pypi/my-private-pkg"},"versions":["99.1.1","0.1.1","99.11.2"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"3e01bd47ce7593342c7243aa95962501e722166b1b00a48b30fe05185f73862851fbef","path":"setup.py","sha256":"8cd83903e488634d917bbfffe4c6cc989888004a7de19e35509885041df42a32"},{"path":"vercel_runtime_python/index.py","sha256":"df6d2c082b08ac77ebe3c6a8db9b2fd9dc607482631224fd120502de81191934","tlsh":"5611cc7a8d618d41977a808ccc078092f2164b236b25fe6bbcfc066daf3000153b0df2"}],"package_integrity":[{"hashes":{"blake2b_256":"6120ed17fac654a5d8e73c68eb5e9ddebe7fa298fc85347e3d656eca67856e0a","md5":"cb7f60550698225c587033bcf99024d7","sha256":"17d77e31dceb38fde6c20c70164515acf24e2e334f9d22858f771cce78594aa8"},"filename":"my_private_pkg-99.1.1-py3-none-any.whl"},{"hashes":{"blake2b_256":"efb0b5cbed785b116759e99b6712106011d810418c9b388dace6d9426f34611b","md5":"ba6ed08758ab5071a9d04458a21e05e0","sha256":"c23d1aefbf0580324d8a4b1caf5c862c7a4146c5c797d5dbc84bb5e37a9ddb4d"},"filename":"my_private_pkg-99.1.1.tar.gz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/my-private-pkg/MAL-2026-17180.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"smiling-hyena","contact":["mailto:smilinghyena4@gmail.com"],"type":"FINDER"}]}