XcT-x-AyOuB

GHSA-c875-m3r6-hgp6

Malicious code in xct-x-ayoub (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (d33575d7ebb1fa670ce8a2f633471492b04319daffe0f1e10dd35841cf2709af)
On `import XcT_x_AyOuB`, the package's top-level `__init__.py` unconditionally starts a Flask HTTP server bound to 0.0.0.0:5000 (configurable via PORT) exposing /start, /stop, /restart, /settings endpoints that drive packet-flood ("spam") functionality against Free Fire game servers (loginbp.ggpolarbear.com, clientbp.ggpolarbear.com, client.{ind,us}.freefiremobile.com). The package ships accs.json containing ~300 third-party Garena Free Fire guest UID/password pairs that are not the installer's; core.py:init_accounts() loads these at startup and authenticates them via POST to https://100067.connect.garena.com/oauth/guest/token/grant (with TLS verification disabled, verify=False, and ssl._create_unverified_context()), then opens persistent sockets to Free Fire login servers. The advertised core function (_spamLoop in core.py) sends openRoom + N spmRoom packets per cycle through the bundled accounts' sockets to flood an attacker-supplied target UID's game room. Installer-side impact: (1) merely importing the package opens a LAN-reachable control surface that any network-adjacent caller can use to direct the installer's host into DoS traffic; (2) the installer's IP is used to authenticate and abuse third-party game accounts redistributed inside the package, attributing TOS-violating and potentially illegal traffic to them; (3) ~300 bundled third-party credentials are distributed to every installer. The package is purpose-built abuse tooling, not a dual-use library with a misuse risk.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/xct-x-ayoub/MAL-2026-4777.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/xct-x-ayoub/MAL-2026-4777.json
- https://pypi.org/project/XcT-x-AyOuB/1.0.0
- https://github.com/advisories/GHSA-c875-m3r6-hgp6

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.