# MAL-2026-10100: Malicious code in proxy-check-i (PyPI)


- **Type:** Malicious package
- **Package:** `proxy-check-i` (PyPI)
- **Published:** 9 Jul 2026

## What is MAL-2026-10100?

MAL-2026-10100 is a malicious package in proxy-check-i, published on 9 Jul 2026. 

### Official description

The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator persistent shell, exec, pty, and TCP port-forwarding on the installer's host. The entry point `proxy-check-i` (declared in the package's console_scripts, mapped to `qsshd.launcher:main`) uses `os.execv` to launch the bundled Go binary. The daemon establishes device identity by writing a `.device_lock` file under `$XDG_CONFIG_HOME`, `/dev/shm`, or `/tmp`, then repeatedly dials out to a relay via `github.com/mydearniko/overthing` (`tunnel.NewServer` with `RelayURI` and `ForwardAddr` pointing at the local SSH listener). SSH authentication only accepts a single hardcoded ed25519 public key embedded at build time via `//go:embed authorized_keys`, so only the key holder can connect. The reverse-connect design bypasses inbound firewalls. PyPI metadata is a cover story: PKG-INFO summary mentions only 'qsshd executable' with no README and no disclosure of SSH-server, authorized-keys, or outbound-relay behavior, so an installer cannot infer they are enabling a remote-shell daemon. Any host that runs `proxy-check-i` is remotely controllable by the key holder.

The embedded binary starts a relayed SSH-like server using a hardcoded authorized_key. Thanks to using a relay network, the attacked does not need to directly expose ports from the machine.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-proxy-check-i

Reasons (based on the campaign):

 - backdoor

 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

## What should I do about MAL-2026-10100?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10100 is a malicious package: proxy-check-i (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10100/ (Markdown: https://insights.sbomify.com/MAL-2026-10100/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10100

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10100/
Summaries are generated and may contain mistakes; the official description above is the record.