Malicious code in qzc690383 (PyPI)

__

Source: amazon-inspector (d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06)

On pip install, setup.py executes shell commands to collect installer host identifiers (id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline) and issues an outbound curl to https://api.ip.sb/ip to retrieve the installer's public IP. The collected fingerprint is base64-encoded and smuggled as 40-character-chunk model names into POST requests to a local Xinference server at http://127.0.0.1:9997/v1/model_registrations/flexible, using xinference.model.flexible.launchers.transformers_launcher as the launcher reference, so an operator with access to that Xinference instance can retrieve the host fingerprint by listing registered models. The build-command guard only skips metadata-only invocations, so the reconnaissance fires on a plain install. The package ships no real library functionality — the install-time code is the entire payload.