MAL-2026-18761

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/infra-libs/MAL-2026-18761.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18761
Published
2026-11-08T09:39:28Z
Modified
2026-11-08T10:15:03Z
Summary
Malicious code in infra-libs (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32)

infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form install-<random-id>-<hostname> and calls socket.getaddrinfo against <label>.testa213022.dssldrf.net, causing the authoritative name server for that zone to receive the installer's platform.node() value during pip install. gcp_log_poc/init.py repeats the same pattern with an import-<id>-<hostname> label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name infra-libs is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022565",
            "import_time": "2026-11-08T10:11:08.930000061Z",
            "modified_time": "2026-11-08T09:39:28Z",
            "sha256": "721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / infra-libs

Package

Name
infra-libs
View open source insights on deps.dev
Purl
pkg:pypi/infra-libs

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "artifacts": [
                "infra_libs-99.99.99.tar.gz"
            ],
            "path": "setup.py",
            "sha256": "9c2886417255e482c684ceef00c8a98f98317958b871b4f183628084e7a4a737",
            "tlsh": "cae06a03d7339d83745115c504f930615f3e19177f31648d774503126f9f05a4437607"
        },
        {
            "artifacts": [
                "infra_libs-99.99.99.tar.gz",
                "infra_libs-99.99.99-py3-none-any.whl"
            ],
            "path": "gcp_log_poc/__init__.py",
            "sha256": "4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e",
            "tlsh": "0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"
        }
    ],
    "package_integrity": [
        {
            "filename": "infra_libs-99.99.99-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "05784fc8901dffe84a3fe2c4f83cbfe929465577818eb26d0757b00f54ddb7b1",
                "md5": "2d0ef9f1cc87477fb789342fffca90d0",
                "sha256": "25ed0efc14f32835fa43902737c17cfebd49ce2ffa9a32d9a139fde275e92b78"
            }
        },
        {
            "filename": "infra_libs-99.99.99.tar.gz",
            "hashes": {
                "blake2b_256": "1bcc02a24eb9211a845ef55dcc871e24cfe71c92babb82aa01dcd114afb158c3",
                "md5": "fc81dacf2fd7c110ccea0d12fee32917",
                "sha256": "a06af23885f3d7497b25c890f5308c370d609a4cae1e28aeca1c585e056b7105"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/infra-libs/MAL-2026-18761.json"