{"id":"MAL-2026-18749","summary":"Malicious code in qzc690382 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e)\nThe package body is inert (`__init__.py` contains only `#c\\n`); the entire functionality lives in setup.py, which runs on `pip install`. During install, setup.py writes a Python HTTP server script to `/tmp/.kxs` and launches it detached via `subprocess.Popen([sys.executable, '/tmp/.kxs'], start_new_session=True)`. The server binds `0.0.0.0` on ports 9998, 9999, 8089, 8099, and 8899 and executes any shell command passed in a GET `c=` query parameter via `subprocess.run(c, shell=True,...)`, gated only by a token stored at `/tmp/.kxq`. The result is a persistent, network-exposed shell on all interfaces of the installing machine, running as the installing user, with no relationship to building or using any advertised functionality.\n","modified":"2026-11-07T10:45:03.851479785Z","published":"2026-11-07T10:21:14Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022544","import_time":"2026-11-07T10:36:42.60566658Z","modified_time":"2026-11-07T10:21:14Z","sha256":"b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/qzc690382/1.0.0/"}],"affected":[{"package":{"name":"qzc690382","ecosystem":"PyPI","purl":"pkg:pypi/qzc690382"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"blake2b_256":"e813dcf8201d16324affbd54e3ecc35ece305f463b9df439b249c3b5ede56889","md5":"d2002c5b7346d040c679c1311b8db494","sha256":"1d06344b7c5cba3d112c71f6fdc5ab43babafa1051ba34546fde08e516fc2a60"},"filename":"qzc690382-1.0.0.tar.gz"}],"evidence_files":[{"artifacts":["qzc690382-1.0.0.tar.gz"],"path":"setup.py","sha256":"6c61e1033d7964b18acdd94bf1e20f930b67ffbd791fd657696f91efd890552e","tlsh":"27416205dc42111697c39ee74422d8622bbe7893f60a887d339e86612fce430c5fa9fd"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/qzc690382/MAL-2026-18749.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}