{"id":"MAL-2026-18124","summary":"Malicious code in journey-test-helloshell (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b)\nsetup.py registers a custom install command (cmdclass install hook) and also fires at module import that connects to the hardcoded bare-IP endpoint 137.131.233.62:8080 and bridges a /bin/bash -i subprocess over the socket, giving the operator interactive shell access on the installer's host. Before opening the shell, the code POSTs host identifiers (hostname, uid, JCX_ENVIRONMENT) over plaintext HTTP to http://137.131.233.62:443/shell-beacon. The install hook double-forks, calls setsid, redirects stdio to /dev/null, and enters an infinite reconnect loop with a 60-second sleep, persisting the backdoor beyond the pip install process. A /tmp/.jcx_channel.done guard file is used to coordinate the channel. Destination is a bare IP unrelated to any publisher domain.\n\n## Source: kam193 (bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9)\nIn specific environments, package starts a reverse shell during installation.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-journey-test-helloshell\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - targetted-attack\n","modified":"2026-10-21T22:45:05.191813107Z","published":"2026-10-21T18:30:25Z","database_specific":{"iocs":{"ips":["137.131.233.62"],"urls":["http://137.131.233.62:443/shell-beacon"]},"malicious-packages-origins":[{"sha256":"bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9","source":"kam193","versions":["0.2.0"],"id":"pypi/2026-10-journey-test-helloshell/journey-test-helloshell","import_time":"2026-10-21T19:14:47.748725857Z","modified_time":"2026-10-21T18:30:25.356628Z"},{"modified_time":"2026-10-21T22:19:50Z","sha256":"0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b","source":"amazon-inspector","versions":["0.2.0"],"id":"IN-MAL-2026-021558","import_time":"2026-10-21T22:41:19.834574184Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/journey-test-helloshell"},{"type":"PACKAGE","url":"https://pypi.org/project/journey-test-helloshell/0.2.0/"}],"affected":[{"package":{"name":"journey-test-helloshell","ecosystem":"PyPI","purl":"pkg:pypi/journey-test-helloshell"},"versions":["0.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"journey_test_helloshell-0.2.0.tar.gz","hashes":{"sha256":"b753d8125d22b8ebaefde52da76fdd47a75c25fdbbdded7e790fce67a49a6bb6","blake2b_256":"24630d199ea7fbc9a2eed448c9b5d766e50a38dc38bd533549b7e719f015177c","md5":"171fc938ad2c138479c652d2ac7975d0"}}],"evidence_files":[{"sha256":"96c8e2608f8bfbaafd226bef8a4e3f405fc1d1ff4dfc76d7724719f3badea586","tlsh":"9de18546ed696471d383d29444328094a7b5bf17aa12a8b87eecd3087fce035c1f87e9","path":"setup.py"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/journey-test-helloshell/MAL-2026-18124.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}