qzc690383

Source: amazon-inspector (d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06)
On `pip install`, setup.py executes shell commands to collect installer host identifiers (id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline) and issues an outbound `curl` to https://api.ip.sb/ip to retrieve the installer's public IP. The collected fingerprint is base64-encoded and smuggled as 40-character-chunk model names into POST requests to a local Xinference server at http://127.0.0.1:9997/v1/model_registrations/flexible, using `xinference.model.flexible.launchers.transformers_launcher` as the launcher reference, so an operator with access to that Xinference instance can retrieve the host fingerprint by listing registered models. The build-command guard only skips metadata-only invocations, so the reconnaissance fires on a plain install. The package ships no real library functionality — the install-time code is the entire payload.

Source: kam193 (50064433aa6b4768163042513bbee6b92d28a48804f5e564ac3532354af7d422)
In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-qzc

Reasons (based on the campaign):

- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

- backdoor

- The package overrides the install command in setup.py to execute malicious code during installation.