If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831)
setup.py in the sdist defines a custom install cmdclass (InstallWithBeacon) that executes during `pip install`. It calls socket.gethostname() and socket.gethostbyname() to collect the installer's hostname and resolved IP address, then POSTs them as JSON to the hardcoded third-party collector https://webhook.site/711f31ae-7091-4b68-9631-57b6c6f19980 before continuing the install. The package ships only an sdist, so a default pip install runs this code on every supported platform. Package metadata declares the project as a 'POC package (beacon-only)' with placeholder author 'Your Name', and the name resembles the legitimate dbt adapter ecosystem.
Source: kam193 (baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.