qzc690383PyPI

On pip install, setup.py executes shell commands to collect installer host identifiers (id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline) and issues an outbound curl to https://api.ip.sb/ip to retrieve the installer's public IP. The collected fingerprint is base64-encoded and smuggled as 40-character-chunk model names into POST requests to a local Xinference server at http://127.0.0.1:9997/v1/model_registrations/flexible, using xinference.model.flexible.launchers.transformers_launcher as the launcher reference, so an operator with access to that Xinference instance can retrieve the host fingerprint by listing registered models. The build-command guard only skips metadata-only invocations, so the reconnaissance fires on a plain install. The package ships no real library functionality — the install-time code is the entire payload.

In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-qzc

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• backdoor

• The package overrides the install command in setup.py to execute malicious code during installation.