qzc690385

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb)
At install time, setup.py polls the local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, selects model registrations whose names begin with 'xcmd0', url-safe-base64-decodes the suffix into a shell command, and runs it via subprocess.run(['/bin/sh', '-c',...]). The stdout/stderr of each execution is chunked, base64-encoded, and written back as new model registrations named 'zqx9p00<out>', 'zqx9p01<out>', 'zqx9err', with a 'zqx9alive' registration used as a liveness beacon. The command bytes are obfuscated as the url-safe-base64 suffix of a model name (reassembled by replacing '-'/'_' and padding '=' before base64 decode), so the payload only materializes after decode. The package has no declared purpose, an empty PKG-INFO, and a random-looking name, and ships no legitimate functionality. The effect is a bidirectional command-execution and output-exfiltration channel driven at pip install time: any party able to post model registrations to the installer's Xinference service (locally, or via SSRF/misconfiguration of that service) can run arbitrary shell commands on the installer's host as the installing user and read the results back through the same registry.

## Source: kam193 (38936057b5c5ae57efbe9fc39bb036a1c848141352548997ae9ddb9d54737468)
In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-11-qzc


Reasons (based on the campaign):


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.


 - backdoor


 - The package overrides the install command in setup.py to execute malicious code during installation.

Compromised versions (14)

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.