MAL-2026-18752: Malicious code in qzc690384 (PyPI)

Published Nov 7, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1) In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remote commands from a hardcoded location. Next stages seem to be downloaded from localhost, what suggests the code may still be a preparation for the real attack.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-qzc

Reasons (based on the campaign):

- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

- backdoor

- The package overrides the install command in setup.py to execute malicious code during installation.

Affected Software

1 affected component

pip/qzc690384=1.0.0

Event History

Nov 7, 2026

Advisory Published

via OSV·02:41 PM

Data Sourced

via OSV·02:41 PM

DescriptionAffected Software

Frequently Asked Questions

When can the malicious code run?

It runs during package installation because the package overrides the install command in setup.py. Systems that install qzc690384 through pip are therefore exposed before the package is used by an application.

What attacker capabilities does this package enable?

Observed behaviors vary by version and include environment fingerprinting, exfiltration of basic system data such as IP address or username, a backdoor server that listens for remote commands, and downloading commands from a hardcoded location. The available information indicates that remote-command execution may be limited to a specific command set.

What should be investigated if this package was installed?

Treat the host as potentially exposed to basic system-data exfiltration and remote command activity. Investigate installation events for qzc690384, processes or services that may be acting as a backdoor listener, and attempts to retrieve follow-on commands; reported next-stage downloads appear to use localhost.

MAL-2026-18752: Malicious code in qzc690384 (PyPI)

Affected Software

Event History

Frequently Asked Questions

When can the malicious code run?

What attacker capabilities does this package enable?

What should be investigated if this package was installed?

Company

Resources

Contact

Frequently Asked Questions

When can the malicious code run?

What attacker capabilities does this package enable?

What should be investigated if this package was installed?