{"id":"MAL-2026-18751","summary":"Malicious code in qzc690385 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb)\nOn sdist install, setup.py writes a Python HTTP server to /tmp/.zqx and launches it detached via `nohup... &` with `start_new_session=True`. The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8777 and executes arbitrary shell commands received via HTTP GET query parameters, gated only by the hardcoded token `kq7731`. In parallel, setup.py POSTs crafted model-registration payloads to a local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, referencing `xinference.model.flexible.launchers.transformers_launcher.launcher` — a known Xinference abuse path for code execution via model registration. The same POST stream smuggles base64-url-encoded host reconnaissance (python path, listening ports in the backdoor's port range, and process count for `/tmp/.zqx`) in chunks via the `model_name` field (`zqxp%02d\u003cb64\u003e`), using the Xinference registry as both the RCE primitive and a data-return channel. The package provides no legitimate functionality consistent with these behaviors.\n","modified":"2026-11-07T10:45:03.851477087Z","published":"2026-11-07T10:21:05Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022543","import_time":"2026-11-07T10:36:42.4789447Z","modified_time":"2026-11-07T10:21:05Z","sha256":"84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb"},{"sha256":"8fdb508a0701cb28bc4c5613c93d04d825da018b4b1318ed50a53672cb33e1bc","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-022545","import_time":"2026-11-07T10:36:42.670969727Z","modified_time":"2026-11-07T10:21:20Z"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/qzc690385/1.0.1/"}],"affected":[{"package":{"name":"qzc690385","ecosystem":"PyPI","purl":"pkg:pypi/qzc690385"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"blake2b_256":"d89988040c162ba45c2ba9fa502853198c50f044c56289b4c55252d83943f985","md5":"2999895313a23863cd0a3ee7269506ab","sha256":"d94e0d5acdff4d40b504f49a9c258e070201bf4e077e5d674eda702216b2cc08"},"filename":"qzc690385-1.0.0.tar.gz"}],"evidence_files":[{"artifacts":["qzc690385-1.0.0.tar.gz"],"path":"setup.py","sha256":"d2b9c88e30eefcae8d13c3fbc9f7fbba3b597f4809c3b12acea77f564b87282e","tlsh":"4571a341e8115967db87ccb840a0e8622b9e6a4fa107647933bd43661fcc439c6b56fd"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/qzc690385/MAL-2026-18751.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}