MAL-2026-18378

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/poc-revshell/MAL-2026-18378.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18378
Published
2026-10-29T14:59:05Z
Modified
2026-10-29T15:30:07Z
Summary
Malicious code in poc-revshell (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a)

poc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom install cmdclass (PostInstall) that starts a daemon thread executing a routine which opens a TCP socket to 127.0.0.1:4444, dup2s the socket file descriptor onto stdin/stdout/stderr, and execs /bin/sh -i (or cmd.exe on Windows); this runs automatically during pip install. The package's __init__.py contains the same thread-launch at module top level, so every import poc_revshell repeats the handoff. Any local listener on port 4444 at the moment of install or import receives a full interactive shell running under the installing user's identity. The destination is hardcoded loopback, which confines the attack to a co-resident attacker on the installer's host, but the install-time and import-time network-to-shell dataflow is a backdoor by structure, matching the package's self-description as a proof-of-concept that triggers a reverse shell on pip install.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022414",
            "import_time":  "2026-10-29T15:13:33.788406335Z",
            "modified_time":  "2026-10-29T14:59:05Z",
            "sha256":  "08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / poc-revshell

Package

Name
poc-revshell
View open source insights on deps.dev
Purl
pkg:pypi/poc-revshell

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "7a8560000b3c28559aa8ba6c4c8c5d6b16b5738fae910be66056a2100e76e194",
            "tlsh":  "0c019e43c97a30bd6f9302f11057811a5f5395438b00a0bc35ff92509f8f02554ae9ba"
        },
        {
            "path":  "poc_revshell/__init__.py",
            "sha256":  "7ff9a94321c8f4a5dea6592b508600e99605a69b21378dd085eda98b5320343a",
            "tlsh":  "2bf0f1c2ca7c309a9be301f62018c41e2f63e1039601047c36bce260df970b851e8c79"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "poc_revshell-0.1.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "2dff51b1e9de68f2ee111bbd188ae543499bd3ed06ba720d34ccdf903678b936",
                "md5":  "4ef43ac0715e32a5b009510fcc037738",
                "sha256":  "25b6d2d8df76c830bbd54f370b593f980f50c41b7c77157cafe6fc9dcb2f023b"
            }
        },
        {
            "filename":  "poc_revshell-0.1.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "cf91fee4a00aea0bcfd13b08d849133c217c038fe70c7882979fa68c95f5f808",
                "md5":  "62f79645d9045d58e4eac31b3fda6165",
                "sha256":  "055064b179902340bf66ffd5bca29cb26754e2617be3280085c0ea8b4f5e9334"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/poc-revshell/MAL-2026-18378.json"