{"id":"MAL-2026-18750","kind":"package","aliases":["MAL-2026-18750"],"related":[],"title":"Malicious code in qzc690383 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06)\nOn `pip install`, setup.py executes shell commands to collect installer host identifiers (id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline) and issues an outbound `curl` to https://api.ip.sb/ip to retrieve the installer's public IP. The collected fingerprint is base64-encoded and smuggled as 40-character-chunk model names into POST requests to a local Xinference server at http://127.0.0.1:9997/v1/model_registrations/flexible, using `xinference.model.flexible.launchers.transformers_launcher` as the launcher reference, so an operator with access to that Xinference instance can retrieve the host fingerprint by listing registered models. The build-command guard only skips metadata-only invocations, so the reconnaissance fires on a plain install. The package ships no real library functionality — the install-time code is the entire payload.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qzc690383","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T10:21:28+00:00","first_seen_at":"2026-11-07T11:17:32+00:00","triaged_at":"2026-11-07T11:19:20+00:00","updated_at":"2026-11-07T11:27:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18750':8A,11A '-2026':7A,10A '/ip':58C '/proc/1/cmdline':49C '127.0.0.1':91C '40':76C '9997/v1/model_registrations/flexible':92C 'access':104C 'amazon':26C 'amazon-inspector':25C 'api.ip.sb':57C 'api.ip.sb/ip':56C 'base64':71C 'base64-encoded':70C 'build':120C 'build-command':119C 'charact':78C 'character-chunk':77C 'chunk':79C 'code':2A,148C 'collect':37C,67C 'command':35C,121C 'curl':54C 'd4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06':28C 'detail':17C 'edit':20C 'encod':72C 'entir':151C 'execut':33C 'fingerprint':68C,113C 'fire':132C 'function':143C 'guard':122C 'host':39C,112C 'hostnam':43C 'id':41C 'identifi':40C 'inspector':27C 'instal':31C,38C,62C,136C,146C 'install-tim':145C 'instanc':108C 'invoc':128C 'ip':65C 'issu':51C 'launcher':95C,98C 'librari':142C 'line':23C 'list':115C 'local':87C 'mal':6A,9A 'malici':1A,13B 'metadata':126C 'metadata-on':125C 'model':80C,117C 'name':81C 'nvidia':46C 'nvidia-smi':45C 'oper':102C 'outbound':53C 'output':48C 'packag':14B,138C 'payload':152C 'per':15C 'pip':30C 'plain':135C 'post':83C 'public':64C 'pypi':5A 'qzc690383':4A,12A 'real':141C 'reconnaiss':131C 'refer':99C 'regist':116C 'request':84C 'retriev':60C,110C 'server':89C 'setup.py':32C 'shell':34C 'ship':139C 'skip':124C 'smi':47C 'smuggl':74C 'sourc':16C,24C 'time':147C 'unam':44C 'use':93C 'whoami':42C 'xinfer':88C,107C 'xinference.model.flexible.launchers.transformers':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["qzc690383"],"ptokens":["qzc690383"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18750':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'qzc690383':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'/ip':58C '/proc/1/cmdline':49C '127.0.0.1':91C '40':76C '9997/v1/model_registrations/flexible':92C 'access':104C 'amazon':26C 'amazon-inspector':25C 'api.ip.sb':57C 'api.ip.sb/ip':56C 'base64':71C 'base64-encoded':70C 'build':120C 'build-command':119C 'charact':78C 'character-chunk':77C 'chunk':79C 'code':148C 'collect':37C,67C 'command':35C,121C 'curl':54C 'd4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06':28C 'detail':17C 'edit':20C 'encod':72C 'entir':151C 'execut':33C 'fingerprint':68C,113C 'fire':132C 'function':143C 'guard':122C 'host':39C,112C 'hostnam':43C 'id':41C 'identifi':40C 'inspector':27C 'instal':31C,38C,62C,136C,146C 'install-tim':145C 'instanc':108C 'invoc':128C 'ip':65C 'issu':51C 'launcher':95C,98C 'librari':142C 'line':23C 'list':115C 'local':87C 'metadata':126C 'metadata-on':125C 'model':80C,117C 'name':81C 'nvidia':46C 'nvidia-smi':45C 'oper':102C 'outbound':53C 'output':48C 'packag':138C 'payload':152C 'per':15C 'pip':30C 'plain':135C 'post':83C 'public':64C 'real':141C 'reconnaiss':131C 'refer':99C 'regist':116C 'request':84C 'retriev':60C,110C 'server':89C 'setup.py':32C 'shell':34C 'ship':139C 'skip':124C 'smi':47C 'smuggl':74C 'sourc':16C,24C 'time':147C 'unam':44C 'use':93C 'whoami':42C 'xinfer':88C,107C 'xinference.model.flexible.launchers.transformers':94C","first_public_at":"2026-11-07T10:21:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18750","url":"https://osv.dev/vulnerability/MAL-2026-18750","severity":"critical","published_at":"2026-11-07T10:21:28+00:00","modified_at":"2026-11-07T10:45:03+00:00","first_seen_at":"2026-11-07T11:17:32+00:00","fetched_at":"2026-11-07T11:17:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}