qzc690384

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4)
The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operational malware. Scores come from the partial verdict when it carried them; confidence is capped so a person reviews this version before any block.

## Source: kam193 (dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1)
In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-11-qzc


Reasons (based on the campaign):


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.


 - backdoor


 - The package overrides the install command in setup.py to execute malicious code during installation.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.