If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5e9ac24971ad447f0248f201416c1921ca268ddb73ad057eee44eaf4868efb17)
lookuptest11 0.0.1 performs DNS-based exfiltration of installer identity to the attacker-controlled domain testa213022.dssldrf.net. setup.py constructs a subdomain label of the form install-<random>-<hostname> from platform.node() and calls socket.getaddrinfo(label.testa213022.dssldrf.net, 80), causing the authoritative nameserver for that domain to receive the installer's hostname on every sdist build. gcp_log_poc/__init__.py performs the equivalent lookup with an import-<random>-<hostname> label at module load, so the same leak fires on every import of the installed wheel. The package exposes no functional API consistent with its name; the DNS calls are the only observable behavior and have no build or runtime purpose other than delivering host identifiers to the operator of testa213022.dssldrf.net.
Source: kam193 (fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.