MAL-2026-18750: Malicious code in qzc690383 (PyPI)

Published Nov 7, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06) On pip install, setup.py executes shell commands to collect installer host identifiers (id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline) and issues an outbound curl to https://api.ip.sb/ip to retrieve the installer's public IP. The collected fingerprint is base64-encoded and smuggled as 40-character-chunk model names into POST requests to a local Xinference server at http://127.0.0.1:9997/v1/modelregistrations/flexible, using xinference.model.flexible.launchers.transformerslauncher as the launcher reference, so an operator with access to that Xinference instance can retrieve the host fingerprint by listing registered models. The build-command guard only skips metadata-only invocations, so the reconnaissance fires on a plain install. The package ships no real library functionality — the install-time code is the entire payload.

Affected Software

1 affected component

pip/qzc690383=1.0.0

Event History

Nov 7, 2026

Advisory Published

via OSV·10:21 AM

Data Sourced

via OSV·10:21 AM

DescriptionAffected Software

Frequently Asked Questions

What systems are exposed to this package's behavior?

Any host where qzc690383 is installed with pip is exposed during installation. The package runs its reconnaissance from setup.py on a plain install and does not provide real library functionality.

What does the package collect and where does it send it?

It collects host identifiers including id, whoami, hostname, uname, nvidia-smi output, and /proc/1/cmdline, and retrieves the host's public IP from api.ip.sb. It base64-encodes this fingerprint and sends it in POST requests to a local Xinference server at 127.0.0.1:9997.

Is a local Xinference service required for the host data to be recoverable?

The collected data is smuggled into model-registration requests sent to the local Xinference endpoint. An operator with access to that Xinference instance can recover the fingerprint by listing registered models.

How can responders check whether data may have been staged on a host?

Check the Xinference instance at http://127.0.0.1:9997 for flexible model registrations and inspect registered model names for 40-character chunks that may encode the collected fingerprint. Also review whether qzc690383 was installed with pip, since the behavior runs during installation.

MAL-2026-18750: Malicious code in qzc690383 (PyPI)

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to this package's behavior?

What does the package collect and where does it send it?

Is a local Xinference service required for the host data to be recoverable?

How can responders check whether data may have been staged on a host?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this package's behavior?

What does the package collect and where does it send it?

Is a local Xinference service required for the host data to be recoverable?

How can responders check whether data may have been staged on a host?