qzc690385

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb)
On sdist install, setup.py writes a Python HTTP server to /tmp/.zqx and launches it detached via `nohup... &` with `start_new_session=True`. The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8777 and executes arbitrary shell commands received via HTTP GET query parameters, gated only by the hardcoded token `kq7731`. In parallel, setup.py POSTs crafted model-registration payloads to a local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, referencing `xinference.model.flexible.launchers.transformers_launcher.launcher` — a known Xinference abuse path for code execution via model registration. The same POST stream smuggles base64-url-encoded host reconnaissance (python path, listening ports in the backdoor's port range, and process count for `/tmp/.zqx`) in chunks via the `model_name` field (`zqxp%02d<b64>`), using the Xinference registry as both the RCE primitive and a data-return channel. The package provides no legitimate functionality consistent with these behaviors.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e36b77c257151f9a76f303a0b3259ae3140d3a18/osv/malicious/pypi/qzc690385/MAL-2026-18751.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e36b77c257151f9a76f303a0b3259ae3140d3a18/osv/malicious/pypi/qzc690385/MAL-2026-18751.json
- https://pypi.org/project/qzc690385/1.0.0
- https://pypi.org/project/qzc690385/1.0.1
- https://bad-packages.kam193.eu/pypi/package/qzc690385
- https://github.com/ossf/malicious-packages/blob/e3cb1fb7f7c3ea7aac52daa1e388c7ac2249f67e/osv/malicious/pypi/qzc690385/MAL-2026-18751.json
- https://github.com/ossf/malicious-packages/blob/d7d569fb443d44db44ee0cf66793ac2206e0a129/osv/malicious/pypi/qzc690385/MAL-2026-18751.json
- https://pypi.org/project/qzc690385/1.0.2
- https://pypi.org/project/qzc690385/1.0.3

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.