{"items":[{"id":"NVI-00008665","kind":"supply_chain_event","title":"Malicious code in poc-revshell (PyPI)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h7h9-fmhv-56wh"],"plain_summary":"GitHub lists this malware advisory for poc-revshell. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a17990659ca41f3853942745a8de529b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a17990659ca41f3853942745a8de529b","url":"https://github.com/advisories/GHSA-h7h9-fmhv-56wh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h7h9-fmhv-56wh","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:43.056Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a17990659ca41f3853942745a8de529b"],"technology":"poc-revshell","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a)\npoc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom `install` cmdclass (PostInstall) that starts a daemon thread executing a routine which opens a TCP socket to 127.0.0.1:4444, dup2s the socket file descriptor onto stdin/stdout/stderr, and execs `/bin/sh -i` (or `cmd.exe` on Windows); this runs automatically during `pip install`. The package's `__init__.py` contains the same thread-launch at module top level, so every `import poc_revshell` repeats the handoff. Any local listener on port 4444 at the moment of install or import receives a full interactive shell running under the installing user's identity. The destination is hardcoded loopback, which confines the attack to a co-resident attacker on the installer's host, but the install-time and import-time network-to-shell dataflow is a backdoor by structure, matching the package's self-description as a proof-of-concept that triggers a reverse shell on pip install.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/oss","public_affected_ranges":["= 0.1.0"]}],"null_published_at":"2026-10-31T22:13:27.106Z","source_updated_at":"2026-10-29T15:31:28.000Z","source_disclosed_at":"2026-10-29T15:31:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:43.056Z"}],"next_cursor":null,"snapshot_revision":"42594"}