{"id":"MAL-2026-18751","kind":"package","aliases":["MAL-2026-18751"],"related":[],"title":"Malicious code in qzc690385 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb)\nOn sdist install, setup.py writes a Python HTTP server to /tmp/.zqx and launches it detached via `nohup... &` with `start_new_session=True`. The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8777 and executes arbitrary shell commands received via HTTP GET query parameters, gated only by the hardcoded token `kq7731`. In parallel, setup.py POSTs crafted model-registration payloads to a local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, referencing `xinference.model.flexible.launchers.transformers_launcher.launcher` — a known Xinference abuse path for code execution via model registration. The same POST stream smuggles base64-url-encoded host reconnaissance (python path, listening ports in the backdoor's port range, and process count for `/tmp/.zqx`) in chunks via the `model_name` field (`zqxp%02d<b64>`), using the Xinference registry as both the RCE primitive and a data-return channel. The package provides no legitimate functionality consistent with these behaviors.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qzc690385","fixed":[],"affected":"= 1.0.0; = 1.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T10:21:05+00:00","first_seen_at":"2026-11-07T11:17:32+00:00","triaged_at":"2026-11-07T11:19:20+00:00","updated_at":"2026-11-07T11:27:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18751':8A,11A '-2026':7A,10A '/tmp/.zqx':39C,136C '0.0.0.0':54C '02d':145C '127.0.0.1':96C '8089':59C '8099':60C '84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb':28C '8777':62C '9997/v1/model_registrations/flexible':97C '9998':57C '9999':58C 'abus':103C 'amazon':26C 'amazon-inspector':25C 'api':94C 'arbitrari':65C 'backdoor':128C 'base64':117C 'base64-url-encoded':116C 'behavior':170C 'bind':53C 'channel':160C 'chunk':138C 'code':2A,106C 'command':67C 'consist':167C 'count':134C 'craft':85C 'data':158C 'data-return':157C 'detach':43C 'detail':17C 'edit':20C 'encod':119C 'execut':64C,107C 'field':143C 'function':166C 'gate':74C 'get':71C 'hardcod':78C 'host':120C 'http':36C,70C 'inspector':27C 'instal':31C 'known':101C 'kq7731':80C 'launch':41C 'legitim':165C 'line':23C 'listen':124C 'local':92C 'mal':6A,9A 'malici':1A,13B 'model':87C,109C,141C 'model-registr':86C 'name':142C 'new':48C 'nohup':45C 'packag':14B,162C 'parallel':82C 'paramet':73C 'path':104C,123C 'payload':89C 'per':15C 'port':56C,125C,130C 'post':84C,113C 'primit':154C 'process':133C 'provid':163C 'pypi':5A 'python':35C,122C 'queri':72C 'qzc690385':4A,12A 'rang':131C 'rce':153C 'receiv':68C 'reconnaiss':121C 'referenc':98C 'registr':88C,110C 'registri':149C 'return':159C 'sdist':30C 'server':37C,52C 'session':49C 'setup.py':32C,83C 'shell':66C 'smuggl':115C 'sourc':16C,24C 'start':47C 'stream':114C 'token':79C 'true':50C 'url':118C 'use':146C 'via':44C,69C,108C,139C 'write':33C 'xinfer':93C,102C,148C 'xinference.model.flexible.launchers.transformers_launcher.launcher':99C 'zqxp':144C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["qzc690385"],"ptokens":["qzc690385"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18751':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'qzc690385':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'/tmp/.zqx':39C,136C '0.0.0.0':54C '02d':145C '127.0.0.1':96C '8089':59C '8099':60C '84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb':28C '8777':62C '9997/v1/model_registrations/flexible':97C '9998':57C '9999':58C 'abus':103C 'amazon':26C 'amazon-inspector':25C 'api':94C 'arbitrari':65C 'backdoor':128C 'base64':117C 'base64-url-encoded':116C 'behavior':170C 'bind':53C 'channel':160C 'chunk':138C 'code':106C 'command':67C 'consist':167C 'count':134C 'craft':85C 'data':158C 'data-return':157C 'detach':43C 'detail':17C 'edit':20C 'encod':119C 'execut':64C,107C 'field':143C 'function':166C 'gate':74C 'get':71C 'hardcod':78C 'host':120C 'http':36C,70C 'inspector':27C 'instal':31C 'known':101C 'kq7731':80C 'launch':41C 'legitim':165C 'line':23C 'listen':124C 'local':92C 'model':87C,109C,141C 'model-registr':86C 'name':142C 'new':48C 'nohup':45C 'packag':162C 'parallel':82C 'paramet':73C 'path':104C,123C 'payload':89C 'per':15C 'port':56C,125C,130C 'post':84C,113C 'primit':154C 'process':133C 'provid':163C 'python':35C,122C 'queri':72C 'rang':131C 'rce':153C 'receiv':68C 'reconnaiss':121C 'referenc':98C 'registr':88C,110C 'registri':149C 'return':159C 'sdist':30C 'server':37C,52C 'session':49C 'setup.py':32C,83C 'shell':66C 'smuggl':115C 'sourc':16C,24C 'start':47C 'stream':114C 'token':79C 'true':50C 'url':118C 'use':146C 'via':44C,69C,108C,139C 'write':33C 'xinfer':93C,102C,148C 'xinference.model.flexible.launchers.transformers_launcher.launcher':99C 'zqxp':144C","first_public_at":"2026-11-07T10:21:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18751","url":"https://osv.dev/vulnerability/MAL-2026-18751","severity":"critical","published_at":"2026-11-07T10:21:05+00:00","modified_at":"2026-11-07T10:45:03+00:00","first_seen_at":"2026-11-07T11:17:32+00:00","fetched_at":"2026-11-07T11:17:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}