prosocks

GHSA-6v7p-c53r-646f

Malicious code in prosocks (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (a1ca37b881f19975a8ab8b23bd5e69b51355333374385aabfc5784b69bf95545)
The package automatically joins the machine to a proxy network. Depending on the version, it can happen during the package installation or when importing the module.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-prosocks


Reasons (based on the campaign):


 - other


 - peristence-autorun


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4a3556b94ba152c3768feac3d6323da00e8f77b/osv/malicious/pypi/prosocks/MAL-2026-17167.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/prosocks
- https://github.com/ossf/malicious-packages/blob/f4a3556b94ba152c3768feac3d6323da00e8f77b/osv/malicious/pypi/prosocks/MAL-2026-17167.json
- https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/pypi/prosocks/MAL-2026-17167.json
- https://pypi.org/project/prosocks/1.0.13
- https://pypi.org/project/prosocks/1.0.17
- https://pypi.org/project/prosocks/1.0.18
- https://pypi.org/project/prosocks/1.0.19
- https://pypi.org/project/prosocks/1.0.20

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.