If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (108ea237ed659c21bd0e896db8184187b0c6e34b07d1c7659365db70e8857551)
On import of the top-level mcp_teamviewer module, the package constructs a DNS label from the installer's USER/USERNAME, hostname (platform.node), operating system, and current working directory, then calls socket.getaddrinfo() against that label as a subdomain of oast.me (an out-of-band interact collector). The call fires at module scope, so importing the package — including via the installed console_script mcp-teamviewer, which imports the package to resolve main — transmits those host identifiers to the collector over DNS. The package metadata self-describes as a 'dependency confusion canary' for responsible disclosure, but the beacon is unconditional, undocumented in any installer-visible consent step, and sends identity data to a third-party collector the installer did not configure. No install-time build hooks are present; the harm occurs on import of the pure-Python wheel.
Source: kam193 (54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
Source: ossf-package-analysis (a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff)
The OpenSSF Package Analysis project identified 'mcp-teamviewer' @ 0.0.1 (pypi) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.