취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (42e53a38c2df70a3c6a2a24b2484840e6a163f2e1a9b91236a2aa7a9ec004600)

On first import, src/acme_widget_layout_utils/init.py (lines 13-17) opens a TCP socket to 34.69.137.236:80, duplicates stdin/stdout/stderr onto the socket via os.dup2, and execs /bin/sh -i — a textbook interactive reverse shell handing remote shell access to whoever controls 34.69.137.236. The behavior is unconditional and fires the moment any consumer runs import acme_widget_layout_utils. setup.py additionally installs a custom install command that writes /tmp/pypi_install_hook_marker.txt at install time, corroborating the package's role as a deliberately crafted attack artifact. The package name suggests benign UI/layout utilities and contains no such functionality; the pyproject.toml description openly self-identifies as a 'pentest C2 target', but the package is published on public PyPI under a generic name where any developer searching for widget/layout helpers can incidentally install and be backdoored. README's 'authorized pentest' framing does not change installer-side impact.

Source: kam193 (643a7c935e2bb063cea8baf36f13bca89572d1febbf0efdb05812ee09ddde4d8)

During import, the package starts a reverse shell.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-acme-widget-layout-utils

Reasons (based on the campaign):

• The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.