MAL-2026-18378: Malicious code in poc-revshell (PyPI)

Published Oct 29, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a) poc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom install cmdclass (PostInstall) that starts a daemon thread executing a routine which opens a TCP socket to 127.0.0.1:4444, dup2s the socket file descriptor onto stdin/stdout/stderr, and execs /bin/sh -i (or cmd.exe on Windows); this runs automatically during pip install. The package's init.py contains the same thread-launch at module top level, so every import pocrevshell repeats the handoff. Any local listener on port 4444 at the moment of install or import receives a full interactive shell running under the installing user's identity. The destination is hardcoded loopback, which confines the attack to a co-resident attacker on the installer's host, but the install-time and import-time network-to-shell dataflow is a backdoor by structure, matching the package's self-description as a proof-of-concept that triggers a reverse shell on pip install.

Affected Software

1 affected component

pip/poc-revshell=0.1.0

Event History

Oct 29, 2026

Advisory Published

via OSV·02:59 PM

Data Sourced

via OSV·02:59 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this package in practice?

Exploitation requires an attacker or malicious process to be co-resident on the same host and listening on 127.0.0.1:4444 when the package is installed or imported. The hardcoded loopback destination prevents a remote host from directly receiving the shell.

What actions trigger the backdoor?

The backdoor runs automatically during pip installation through a custom install command. It also runs each time poc_revshell is imported, because the package launches the same routine at module top level.

What access does an attacker obtain?

A listener on local port 4444 receives an interactive shell under the identity of the user performing the installation or import. The package redirects standard input, output, and error to that socket before executing a shell.

How can I determine whether a host may have been exposed?

Check whether poc-revshell version 0.1.0 was installed or imported, and review local activity for listeners or connections involving 127.0.0.1:4444 at those times. A shell received by a local listener would run as the user that installed or imported the package.

MAL-2026-18378: Malicious code in poc-revshell (PyPI)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this package in practice?

What actions trigger the backdoor?

What access does an attacker obtain?

How can I determine whether a host may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this package in practice?

What actions trigger the backdoor?

What access does an attacker obtain?

How can I determine whether a host may have been exposed?