Malicious code in qzc690384 (PyPI)

---

__

Source: kam193 (dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1)

In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-qzc

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• backdoor

• The package overrides the install command in setup.py to execute malicious code during installation.