qzc690382PyPI

The package body is inert (__init__.py contains only #c\n); the entire functionality lives in setup.py, which runs on pip install. During install, setup.py writes a Python HTTP server script to /tmp/.kxs and launches it detached via subprocess.Popen([sys.executable, '/tmp/.kxs'], start_new_session=True). The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8899 and executes any shell command passed in a GET c= query parameter via subprocess.run(c, shell=True,...), gated only by a token stored at /tmp/.kxq. The result is a persistent, network-exposed shell on all interfaces of the installing machine, running as the installing user, with no relationship to building or using any advertised functionality.

In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-qzc

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• backdoor

• The package overrides the install command in setup.py to execute malicious code during installation.