MAL-2026-18761: Malicious code in infra-libs (PyPI)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32) infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form install-<random-id>-<hostname> and calls socket.getaddrinfo against <label>.testa213022.dssldrf.net, causing the authoritative name server for that zone to receive the installer's platform.node() value during pip install. gcplogpoc/init.py repeats the same pattern with an import-<id>-<hostname> label on every import of the package, and the module docstring explicitly describes the behavior as a 'DNS callback on import.' The destination domain testa213022.dssldrf.net is unrelated to any declared publisher or purpose, the package has no documented functionality that would justify a hostname-encoded DNS lookup, and the name infra-libs is confusable with internal/infrastructure naming conventions commonly targeted by dependency-confusion attacks. No legitimate behavior accompanies the beacon.

Affected Software

1 affected component

pip/infra-libs=99.99.99

Event History

Nov 8, 2026

Advisory Published

via OSV·09:39 AM

Data Sourced

via OSV·09:39 AM

DescriptionAffected Software

Frequently Asked Questions

What information could be exposed if this package is installed or imported?

The package encodes the installer's hostname, obtained from platform.node(), into a DNS query to a domain controlled outside the declared package context. Installation triggers an install-prefixed lookup, and each import triggers an import-prefixed lookup.

When does the malicious network activity occur?

It occurs during pip installation through setup.py and again whenever the package is imported through gcp_log_poc/__init__.py. The import-time behavior is explicitly described in the module as a DNS callback on import.

Which environments are most at risk?

Any environment that installs pip/infra-libs or imports it is exposed to hostname disclosure through DNS, including build systems and runtime environments. The package name may be particularly relevant where dependency names resembling internal infrastructure libraries are used.

How can I check whether this behavior occurred?

Review DNS telemetry for queries to testa213022.dssldrf.net. Relevant query labels begin with install- or import- and include a random identifier and the hostname.

MAL-2026-18761: Malicious code in infra-libs (PyPI)

Affected Software

Event History

Frequently Asked Questions

What information could be exposed if this package is installed or imported?

When does the malicious network activity occur?

Which environments are most at risk?

How can I check whether this behavior occurred?

Company

Resources

Contact

Frequently Asked Questions

What information could be exposed if this package is installed or imported?

When does the malicious network activity occur?

Which environments are most at risk?

How can I check whether this behavior occurred?