{"id":"MAL-2026-18758","kind":"package","aliases":["MAL-2026-18758"],"related":[],"title":"Malicious code in blender-headless (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775)\nThe sdist setup.py and the gcp_log_poc/__init__.py module both construct a DNS label of the form `{install|import}-{random-id}.blender-headless-{platform.node()}` as a subdomain of finaltests99.dssldrf.net and resolve it via socket.getaddrinfo. This leaks the installer's hostname and install/import event to the authoritative server for that domain over DNS, a channel that bypasses typical HTTP egress controls. The setup.py path runs during `pip install` of the sdist; the __init__.py path runs on every `import gcp_log_poc` in any Python process. The package has no build logic and no functionality matching its name — the shipped module name (gcp_log_poc) and the package name (blender-headless) are unrelated, and the module's only behavior is the DNS beacon.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"blender-headless","fixed":[],"affected":"= 9.99.9","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T09:39:34+00:00","first_seen_at":"2026-11-08T11:17:07+00:00","triaged_at":"2026-11-08T11:17:42+00:00","updated_at":"2026-11-08T11:22:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18758':10A,13A '-2026':9A,12A '7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775':32C 'amazon':30C 'amazon-inspector':29C 'authorit':80C 'beacon':157C 'behavior':153C 'blender':5A,15A,56C,144C 'blender-headless':4A,14A,55C,143C 'build':124C 'bypass':90C 'channel':88C 'code':2A 'construct':43C 'control':94C 'detail':21C 'dns':45C,86C,156C 'domain':84C 'edit':24C 'egress':93C 'event':77C 'everi':111C 'finaltests99.dssldrf.net':63C 'form':49C 'function':128C 'gcp':38C,113C,136C 'headless':6A,16A,57C,145C 'hostnam':74C 'http':92C 'id':54C 'import':51C,112C 'init':106C 'inspector':31C 'instal':50C,72C,101C 'install/import':76C 'label':46C 'leak':70C 'line':27C 'log':39C,114C,137C 'logic':125C 'mal':8A,11A 'malici':1A,17B 'match':129C 'modul':41C,134C,150C 'name':131C,135C,142C 'packag':18B,121C,141C 'path':97C,108C 'per':19C 'pip':100C 'platform.node':58C 'poc':115C,138C 'poc/__init__.py':40C 'process':119C 'py':107C 'pypi':7A 'python':118C 'random':53C 'random-id':52C 'resolv':65C 'run':98C,109C 'sdist':34C,104C 'server':81C 'setup.py':35C,96C 'ship':133C 'socket.getaddrinfo':68C 'sourc':20C,28C 'subdomain':61C 'typic':91C 'unrel':147C 'via':67C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["blenderheadless"],"ptokens":["blender","headless"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18758':10A,13A '-2026':9A,12A 'blender':5A,15A 'blender-headless':4A,14A 'code':2A 'headless':6A,16A 'mal':8A,11A 'malici':1A 'pypi':7A","search_b":"'malici':17B 'packag':18B","search_c":"'7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775':32C 'amazon':30C 'amazon-inspector':29C 'authorit':80C 'beacon':157C 'behavior':153C 'blender':56C,144C 'blender-headless':55C,143C 'build':124C 'bypass':90C 'channel':88C 'construct':43C 'control':94C 'detail':21C 'dns':45C,86C,156C 'domain':84C 'edit':24C 'egress':93C 'event':77C 'everi':111C 'finaltests99.dssldrf.net':63C 'form':49C 'function':128C 'gcp':38C,113C,136C 'headless':57C,145C 'hostnam':74C 'http':92C 'id':54C 'import':51C,112C 'init':106C 'inspector':31C 'instal':50C,72C,101C 'install/import':76C 'label':46C 'leak':70C 'line':27C 'log':39C,114C,137C 'logic':125C 'match':129C 'modul':41C,134C,150C 'name':131C,135C,142C 'packag':121C,141C 'path':97C,108C 'per':19C 'pip':100C 'platform.node':58C 'poc':115C,138C 'poc/__init__.py':40C 'process':119C 'py':107C 'python':118C 'random':53C 'random-id':52C 'resolv':65C 'run':98C,109C 'sdist':34C,104C 'server':81C 'setup.py':35C,96C 'ship':133C 'socket.getaddrinfo':68C 'sourc':20C,28C 'subdomain':61C 'typic':91C 'unrel':147C 'via':67C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T09:39:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18758","url":"https://osv.dev/vulnerability/MAL-2026-18758","severity":"critical","published_at":"2026-11-08T09:39:34+00:00","modified_at":"2026-11-08T10:15:04+00:00","first_seen_at":"2026-11-08T11:17:07+00:00","fetched_at":"2026-11-08T11:17:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}