If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32)
infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form `install-<random-id>-<hostname>` and calls socket.getaddrinfo against `<label>.testa213022.dssldrf.net`, causing the authoritative name server for that zone to receive the installer's platform.node() value during `pip install`. gcp_log_poc/__init__.py repeats the same pattern with an `import-<id>-<hostname>` label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name `infra-libs` is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.
Source: kam193 (2796ca84a4fd5c8e195f4b1a5cd7ce752c3a13c34e015ea1ce0436a2774c3b8d)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.