If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76)
setup.py and gcp_log_poc/__init__.py read the installer's hostname via platform.node() and encode it into a subdomain of testa213022.dssldrf.net, then invoke socket.getaddrinfo() to trigger DNS resolution to that domain's authoritative server. This causes the installer's hostname to be exfiltrated to a non-first-party DNS server both when pip builds/installs the package (setup.py) and whenever the installed module is imported. The destination domain is unrelated to any legitimate purpose declared by the package, the package name (`expect-tests`) and the imported module name (`gcp_log_poc`) do not match, and the behavior is undisclosed. The 99.99.99 version number and name-vs-module mismatch are consistent with a dependency-confusion / name-squat lure.
Source: kam193 (a39f8a715e51027cca924163b2f9da3864a4f21a1707f9936e658058ddde5f4a)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.