{"id":"MAL-2026-18378","summary":"Malicious code in poc-revshell (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a)\npoc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom `install` cmdclass (PostInstall) that starts a daemon thread executing a routine which opens a TCP socket to 127.0.0.1:4444, dup2s the socket file descriptor onto stdin/stdout/stderr, and execs `/bin/sh -i` (or `cmd.exe` on Windows); this runs automatically during `pip install`. The package's `__init__.py` contains the same thread-launch at module top level, so every `import poc_revshell` repeats the handoff. Any local listener on port 4444 at the moment of install or import receives a full interactive shell running under the installing user's identity. The destination is hardcoded loopback, which confines the attack to a co-resident attacker on the installer's host, but the install-time and import-time network-to-shell dataflow is a backdoor by structure, matching the package's self-description as a proof-of-concept that triggers a reverse shell on pip install.\n","modified":"2026-10-29T15:30:07.003946627Z","published":"2026-10-29T14:59:05Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-29T15:13:33.788406335Z","modified_time":"2026-10-29T14:59:05Z","sha256":"08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-022414"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/poc-revshell/0.1.0/"}],"affected":[{"package":{"name":"poc-revshell","ecosystem":"PyPI","purl":"pkg:pypi/poc-revshell"},"versions":["0.1.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"setup.py","sha256":"7a8560000b3c28559aa8ba6c4c8c5d6b16b5738fae910be66056a2100e76e194","tlsh":"0c019e43c97a30bd6f9302f11057811a5f5395438b00a0bc35ff92509f8f02554ae9ba"},{"tlsh":"2bf0f1c2ca7c309a9be301f62018c41e2f63e1039601047c36bce260df970b851e8c79","path":"poc_revshell/__init__.py","sha256":"7ff9a94321c8f4a5dea6592b508600e99605a69b21378dd085eda98b5320343a"}],"package_integrity":[{"filename":"poc_revshell-0.1.0-py3-none-any.whl","hashes":{"md5":"4ef43ac0715e32a5b009510fcc037738","sha256":"25b6d2d8df76c830bbd54f370b593f980f50c41b7c77157cafe6fc9dcb2f023b","blake2b_256":"2dff51b1e9de68f2ee111bbd188ae543499bd3ed06ba720d34ccdf903678b936"}},{"hashes":{"md5":"62f79645d9045d58e4eac31b3fda6165","sha256":"055064b179902340bf66ffd5bca29cb26754e2617be3280085c0ea8b4f5e9334","blake2b_256":"cf91fee4a00aea0bcfd13b08d849133c217c038fe70c7882979fa68c95f5f808"},"filename":"poc_revshell-0.1.0.tar.gz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/poc-revshell/MAL-2026-18378.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}