{"id":"MAL-2026-18378","title":"Malicious code in poc-revshell (PyPI)","summary":"Malicious code in poc-revshell (PyPI)","severity":"critical","exploited":true,"vendor":"poc-revshell","product":"poc-revshell","ecosystem":"pip","affected":["poc-revshell"],"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T15:30:07.003946627Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18378","references":[{"url":"https://pypi.org/project/poc-revshell/0.1.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-29T19:04:22.670Z","slug":"MAL-2026-18378","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a)\npoc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom `install` cmdclass (PostInstall) that starts a daemon thread executing a routine which opens a TCP socket to 127.0.0.1:4444, dup2s the socket file descriptor onto stdin/stdout/stderr, and execs `/bin/sh -i` (or `cmd.exe` on Windows); this runs automatically during `pip install`. The package's `__init__.py` contains the same thread-launch at module top level, so every `import poc_revshell` repeats the handoff. Any local listener on port 4444 at the moment of install or import receives a full interactive shell running under the installing user's identity. The destination is hardcoded loopback, which confines the attack to a co-resident attacker on the installer's host, but the install-time and import-time network-to-shell dataflow is a backdoor by structure, matching the package's self-description as a proof-of-concept that triggers a reverse shell on pip install.\n\n\n## Affected packages\n\n- `poc-revshell`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}