{"id":"MAL-2026-18761","summary":"Malicious code in infra-libs (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32)\ninfra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form `install-\u003crandom-id\u003e-\u003chostname\u003e` and calls socket.getaddrinfo against `\u003clabel\u003e.testa213022.dssldrf.net`, causing the authoritative name server for that zone to receive the installer's platform.node() value during `pip install`. gcp_log_poc/__init__.py repeats the same pattern with an `import-\u003cid\u003e-\u003chostname\u003e` label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name `infra-libs` is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.\n","modified":"2026-11-08T10:15:03.161866099Z","published":"2026-11-08T09:39:28Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022565","import_time":"2026-11-08T10:11:08.930000061Z","modified_time":"2026-11-08T09:39:28Z","sha256":"721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32","source":"amazon-inspector","versions":["99.99.99"]}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/infra-libs/99.99.99/"}],"affected":[{"package":{"name":"infra-libs","ecosystem":"PyPI","purl":"pkg:pypi/infra-libs"},"versions":["99.99.99"],"database_specific":{"indicators":{"evidence_files":[{"artifacts":["infra_libs-99.99.99.tar.gz"],"path":"setup.py","sha256":"9c2886417255e482c684ceef00c8a98f98317958b871b4f183628084e7a4a737","tlsh":"cae06a03d7339d83745115c504f930615f3e19177f31648d774503126f9f05a4437607"},{"artifacts":["infra_libs-99.99.99.tar.gz","infra_libs-99.99.99-py3-none-any.whl"],"path":"gcp_log_poc/__init__.py","sha256":"4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e","tlsh":"0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"}],"package_integrity":[{"filename":"infra_libs-99.99.99-py3-none-any.whl","hashes":{"sha256":"25ed0efc14f32835fa43902737c17cfebd49ce2ffa9a32d9a139fde275e92b78","blake2b_256":"05784fc8901dffe84a3fe2c4f83cbfe929465577818eb26d0757b00f54ddb7b1","md5":"2d0ef9f1cc87477fb789342fffca90d0"}},{"hashes":{"blake2b_256":"1bcc02a24eb9211a845ef55dcc871e24cfe71c92babb82aa01dcd114afb158c3","md5":"fc81dacf2fd7c110ccea0d12fee32917","sha256":"a06af23885f3d7497b25c890f5308c370d609a4cae1e28aeca1c585e056b7105"},"filename":"infra_libs-99.99.99.tar.gz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/infra-libs/MAL-2026-18761.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}