MAL-2026-18749

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/qzc690382/MAL-2026-18749.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18749
Published
2026-11-07T10:21:14Z
Modified
2026-11-07T10:45:03Z
Summary
Malicious code in qzc690382 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e)

The package body is inert (__init__.py contains only #c\n); the entire functionality lives in setup.py, which runs on pip install. During install, setup.py writes a Python HTTP server script to /tmp/.kxs and launches it detached via subprocess.Popen([sys.executable, '/tmp/.kxs'], start_new_session=True). The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8899 and executes any shell command passed in a GET c= query parameter via subprocess.run(c, shell=True,...), gated only by a token stored at /tmp/.kxq. The result is a persistent, network-exposed shell on all interfaces of the installing machine, running as the installing user, with no relationship to building or using any advertised functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022544",
            "import_time": "2026-11-07T10:36:42.60566658Z",
            "modified_time": "2026-11-07T10:21:14Z",
            "sha256": "b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / qzc690382

Package

Name
qzc690382
View open source insights on deps.dev
Purl
pkg:pypi/qzc690382

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "artifacts": [
                "qzc690382-1.0.0.tar.gz"
            ],
            "path": "setup.py",
            "sha256": "6c61e1033d7964b18acdd94bf1e20f930b67ffbd791fd657696f91efd890552e",
            "tlsh": "27416205dc42111697c39ee74422d8622bbe7893f60a887d339e86612fce430c5fa9fd"
        }
    ],
    "package_integrity": [
        {
            "filename": "qzc690382-1.0.0.tar.gz",
            "hashes": {
                "blake2b_256": "e813dcf8201d16324affbd54e3ecc35ece305f463b9df439b249c3b5ede56889",
                "md5": "d2002c5b7346d040c679c1311b8db494",
                "sha256": "1d06344b7c5cba3d112c71f6fdc5ab43babafa1051ba34546fde08e516fc2a60"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/qzc690382/MAL-2026-18749.json"