MAL-2026-18124

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/journey-test-helloshell/MAL-2026-18124.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18124
Published
2026-10-21T18:30:25Z
Modified
2026-10-21T22:45:05Z
Summary
Malicious code in journey-test-helloshell (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b)

setup.py registers a custom install command (cmdclass install hook) and also fires at module import that connects to the hardcoded bare-IP endpoint 137.131.233.62:8080 and bridges a /bin/bash -i subprocess over the socket, giving the operator interactive shell access on the installer's host. Before opening the shell, the code POSTs host identifiers (hostname, uid, JCX_ENVIRONMENT) over plaintext HTTP to http://137.131.233.62:443/shell-beacon. The install hook double-forks, calls setsid, redirects stdio to /dev/null, and enters an infinite reconnect loop with a 60-second sleep, persisting the backdoor beyond the pip install process. A /tmp/.jcx_channel.done guard file is used to coordinate the channel. Destination is a bare IP unrelated to any publisher domain.

Source: kam193 (bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9)

In specific environments, package starts a reverse shell during installation.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-journey-test-helloshell

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • targetted-attack

Database specific 
{
    "iocs":  {
        "ips":  [
            "137.131.233.62"
        ],
        "urls":  [
            "http://137.131.233.62:443/shell-beacon"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-10-journey-test-helloshell/journey-test-helloshell",
            "import_time":  "2026-10-21T19:14:47.748725857Z",
            "modified_time":  "2026-10-21T18:30:25.356628Z",
            "sha256":  "bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9",
            "source":  "kam193",
            "versions":  [
                "0.2.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021558",
            "import_time":  "2026-10-21T22:41:19.834574184Z",
            "modified_time":  "2026-10-21T22:19:50Z",
            "sha256":  "0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b",
            "source":  "amazon-inspector",
            "versions":  [
                "0.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / journey-test-helloshell

Package

Name
journey-test-helloshell
View open source insights on deps.dev
Purl
pkg:pypi/journey-test-helloshell

Affected ranges

Affected versions

0.*
0.2.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "96c8e2608f8bfbaafd226bef8a4e3f405fc1d1ff4dfc76d7724719f3badea586",
            "tlsh":  "9de18546ed696471d383d29444328094a7b5bf17aa12a8b87eecd3087fce035c1f87e9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "journey_test_helloshell-0.2.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "24630d199ea7fbc9a2eed448c9b5d766e50a38dc38bd533549b7e719f015177c",
                "md5":  "171fc938ad2c138479c652d2ac7975d0",
                "sha256":  "b753d8125d22b8ebaefde52da76fdd47a75c25fdbbdded7e790fce67a49a6bb6"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/journey-test-helloshell/MAL-2026-18124.json"