INFRA-LIBS · MAL-2026-18761 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form install-<random-id>-<hostname> and calls socket.getaddrinfo against <label>.testa213022.dssldrf.net, causing the authoritative name server for that zone to receive the installer's platform.node() value during pip install. gcp_log_poc/init.py repeats the same pattern with an import-<id>-<hostname> label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name infra-libs is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.