If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb)
At install time, setup.py polls the local Xinference API at http://127.0.0.1:9997/v1/model_registrations/flexible, selects model registrations whose names begin with 'xcmd0', url-safe-base64-decodes the suffix into a shell command, and runs it via subprocess.run(['/bin/sh', '-c',...]). The stdout/stderr of each execution is chunked, base64-encoded, and written back as new model registrations named 'zqx9p00<out>', 'zqx9p01<out>', 'zqx9err', with a 'zqx9alive' registration used as a liveness beacon. The command bytes are obfuscated as the url-safe-base64 suffix of a model name (reassembled by replacing '-'/'_' and padding '=' before base64 decode), so the payload only materializes after decode. The package has no declared purpose, an empty PKG-INFO, and a random-looking name, and ships no legitimate functionality. The effect is a bidirectional command-execution and output-exfiltration channel driven at pip install time: any party able to post model registrations to the installer's Xinference service (locally, or via SSRF/misconfiguration of that service) can run arbitrary shell commands on the installer's host as the installing user and read the results back through the same registry.
Source: kam193 (38936057b5c5ae57efbe9fc39bb036a1c848141352548997ae9ddb9d54737468)
In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-qzc
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- backdoor
- The package overrides the install command in setup.py to execute malicious code during installation.
Source: ossf-package-analysis (71e0c5f67230af29758ff5a4b4feac76f6667c00ca5d5c1552630ca6d98026a3)
The OpenSSF Package Analysis project identified 'qzc690385' @ 1.0.0 (pypi) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.