MAL-2026-18751: Malicious code in qzc690385 (PyPI)

Published Nov 7, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb) On sdist install, setup.py writes a Python HTTP server to /tmp/.zqx and launches it detached via nohup... & with startnewsession=True. The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8777 and executes arbitrary shell commands received via HTTP GET query parameters, gated only by the hardcoded token kq7731. In parallel, setup.py POSTs crafted model-registration payloads to a local Xinference API at http://127.0.0.1:9997/v1/modelregistrations/flexible, referencing xinference.model.flexible.launchers.transformerslauncher.launcher — a known Xinference abuse path for code execution via model registration. The same POST stream smuggles base64-url-encoded host reconnaissance (python path, listening ports in the backdoor's port range, and process count for /tmp/.zqx) in chunks via the modelname field (zqxp%02d<b64>), using the Xinference registry as both the RCE primitive and a data-return channel. The package provides no legitimate functionality consistent with these behaviors.

Affected Software

1 affected component

pip/qzc690385=1.0.0, =1.0.1

Event History

Nov 7, 2026

Advisory Published

via OSV·10:21 AM

Data Sourced

via OSV·10:21 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this package's backdoor?

Systems that install the package from an sdist are exposed, because its setup.py performs the malicious actions during installation. The backdoor binds to 0.0.0.0, so it may be reachable from other network hosts where firewall or network controls permit access.

What does an attacker need to use the HTTP command-execution backdoor?

An attacker needs network access to one of the listener ports 9998, 9999, 8089, 8099, or 8777 and must supply the hardcoded token kq7731. Commands are delivered through HTTP GET query parameters and are executed as shell commands.

How can I check whether a host may already be affected?

Check for a Python HTTP server or related process associated with /tmp/.zqx, and inspect whether any of ports 9998, 9999, 8089, 8099, or 8777 are listening. Also review access to the local Xinference API at 127.0.0.1:9997 and its flexible model-registration records for model_name values beginning with zqxp.

What should be prioritized if the package was installed?

Treat the host as potentially compromised because the package can execute arbitrary shell commands and attempts to use Xinference model registration for code execution. Remove the package and investigate the detached /tmp/.zqx process, exposed listener ports, and Xinference model-registration activity.

MAL-2026-18751: Malicious code in qzc690385 (PyPI)

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this package's backdoor?

What does an attacker need to use the HTTP command-execution backdoor?

How can I check whether a host may already be affected?

What should be prioritized if the package was installed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this package's backdoor?

What does an attacker need to use the HTTP command-execution backdoor?

How can I check whether a host may already be affected?

What should be prioritized if the package was installed?