취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee)

The package advertises itself as a REST client for a captcha-solving API, but the shipped captcha_solve_api module is a ~20-line stub. The tarball's real payload is two top-level modules (_telemetry_init, _telemetry_transport, ~117 KB) installed as global site modules together with a telemetry.pth file copied into site-packages by a custom install command. The.pth contains import _telemetry_init, which Python auto-executes on every interpreter start — independent of whether captcha_solve_api is ever imported. _telemetry_init spawns a daemon thread that instantiates _telemetry_transport.Client and calls initialize()/track(). The runtime collects host identifiers (platform.node() hostname, cpu_count, OS/arch, Python version, session identifiers) and POSTs JSON envelopes to /api/envelope on a destination host that is not hardcoded: a ServiceDiscovery class issues DNS TXT queries to 8.8.8.8 and 1.1.1.1 and base64-decodes concatenated TXT chunks to reconstruct the endpoint, allowing the operator to rotate destinations after install and evade domain/IP allowlists. Author metadata is a generic placeholder ('Platform Engineering') and the DSN docstring uses dev@example.com. The 'telemetry'/'analytics SDK' framing does not match the advertised captcha-solving purpose and is not part of the captcha_solve_api namespace.

Source: kam193 (6745bff1a72b44a9e53129210993aa7a3d0b95e8d9a0a2b2cdfe91324a8e8477)

Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from one of c..dl.well1[.]site domains, depending on the system. This record returns a number, which is then used to iterate over domains in the form <0...n>..dl.well1[.]site and reconstruct the encoded executable from their TXT records. The downloaded binary is then executed and removed afterward. Using a PTH file ensures persistence and runs on every Python start. In this campaign, versions 0.0.1 hold disarmed code (without the necessary configuration), which is completed in further updates.

This is a continuation of the 2026-07-haproxy-config-client campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-andreiiiiiii_i

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.

• Downloads and executes a remote executable.

• covering-tracks

• persistence

• abuses-pth

• data-stored-in-dns