cosmos-gradio

GHSA-q88c-7xgc-cvpc

Malicious code in cosmos-gradio (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 9999.0.0`

## Source: amazon-inspector (9bf1266e0846a392e9aaa6805756d26dc427a04415e8a422d53ffce7a1a0c2e2)
cosmos-gradio 9999.0.0 is a dependency-confusion squat published as an sdist-only release with an intentionally inflated version to win highest-version resolution on installers that mix a private index with PyPI. setup.py (executed at sdist build/install) and cosmos_gradio/__init__.py (executed on import) run the same beacon that collects the installer's hostname, OS username, and current working directory and transmits them to the hardcoded domain oob.asyncrun.in via two channels: (1) a DNS lookup where the '<hostname>|<user>' pair is base32-encoded into a subdomain label under oob.asyncrun.in (out-of-band DNS exfiltration that works even when HTTP egress is blocked), and (2) an HTTP GET carrying the same fields as query-string parameters, with HTTPS attempted first and a plaintext-HTTP fallback. The package name collides with a plausible internal 'cosmos-gradio' package and the release is sdist-only specifically to force setup.py execution on pip install.

## Source: kam193 (4d4ef10feeb0a6a16e38e35a866181dda9f270340238049becb9532b4dce2841)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.


---

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.


Campaign: GENERIC-standard-pypi-install-pentest


Reasons (based on the campaign):


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.


 - The package overrides the install command in setup.py to execute malicious code during installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/cosmos-gradio/MAL-2026-10618.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/cosmos-gradio
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/cosmos-gradio/MAL-2026-10618.json
- https://pypi.org/project/cosmos-gradio/9999.0.0
- https://github.com/advisories/GHSA-q88c-7xgc-cvpc

Compromised versions (1)

= 9999.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.