If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (23181d1a705554588eb6fb03e8cee4af7e0c815e74d8b40d7bd13a39944ccae9)
The distribution `changes-lxc-wrapper` ships a trivial package whose top-level import name is `ca_certificates`, creating a mismatch between the distribution name and the import namespace it occupies. The shipped `__init__.py` only defines a `__version__` constant and an `info()` function returning a placeholder string. There are no install or build hooks, no top-level import-time side effects, no subprocess or network activity, and no credential or filesystem access. Package metadata is placeholder (`Your Name` / `you@example.com`). No installer-side harmful behavior is present in the shipped code; the only concern is namespace shadowing on the common `ca_certificates` import name.
Source: kam193 (6db4cc796d2ddd54fcbb0a46270cff980f711a93a5fff30675499291d9bc41f8)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.