PyPI typosquat backdoor trio qzc690382/383/385 — install-time RCE shell and host recon via Xinference abuse
Severity: critical · Patch status: no-fix-needed · Since 2026-11-07
Three malicious PyPI packages (qzc690382, qzc690383, qzc690385, all version 1.0.0; qzc690385 also 1.0.1) were published and flagged by GitHub Advisory Database / OpenSSF / Amazon Inspector on 2026-11-07. All ship no real functionality; setup.py executes on plain pip install. qzc690382 and qzc690385 drop detached Python HTTP backdoors bound on 0.0.0.0 across ports 9998/9999/8089/8099/8899 (and 8777), executing arbitrary shell commands from GET requests gated only by a token, giving a persistent network-exposed shell as the installing user. qzc690383 and qzc690385 additionally fingerprint the host (id, whoami, hostname, uname, nvidia-smi, public IP) and exfiltrate it base64-encoded as fake model names to a local Xinference server on 127.0.0.1:9997, which also serves as a code-execution abuse path. No patched versions exist; the packages should be removed and hosts inspected.
What to do
- Check whether qzc690382, qzc690383 or qzc690385 (1.0.0/1.0.1) appear in pip logs, lockfiles or site-packages; treat any install as compromise
- On affected hosts, kill processes running /tmp/.kxs or /tmp/.zqx, delete those files and /tmp/.kxq, and audit listening ports 9998, 9999, 8089, 8099, 8899, 8777
- Review Xinference model registrations for suspicious flexible-launcher entries used as a data-exfil/RCE channel
- Hunt for commands executed via the backdoor's shell endpoint and rotate credentials used on installing accounts
- Block these package names in internal PyPI mirrors/proxies and require hash-pinned dependencies
Sources
All live incidents on Threat Watch
