If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9477dba93cdb5c9d325a028365bb7c4667531c8ac9e08d563e6a9573fae86809)
rcp-ndcg 9999.0.0 is a dependency-confusion proof-of-concept squatting an unclaimed name referenced by cohere-ai's rcp-ndcg README, using an implausibly high version (9999.0.0) to win resolution against any internal package of that name. setup.py performs socket.getaddrinfo() to rcp-ndcg-build.<token>.oast.site at sdist build time, and src/rcp_ndcg/__init__.py performs a sibling getaddrinfo() to rcp-ndcg-import.<token>.oast.site on import. Both subdomains resolve through Interactsh (oast.site), a third-party out-of-band DNS collector controlled by the publisher, so each install and each import leaks the event and the resolver's IP to that collector. The package ships no legitimate functionality; its only observable behavior is the beacon. The sdist builds on all listed default platforms, so a plain `pip install rcp-ndcg` triggers the install-time callback, and any later `import rcp_ndcg` triggers the import-time callback.
Source: kam193 (5aa5f39fdbcfd160716eebb87c6bb303d9d6e08eb1beacee5a9a90f228fe7fff)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
Source: ossf-package-analysis (fc78014eaba6dbdc0a485f1954874cbfa65b71ffcda55b1b9337807004e42a2f)
The OpenSSF Package Analysis project identified 'rcp-ndcg' @ 9999.0.0 (pypi) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.