MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)

pypi package zagents-message-bus is published at an implausibly inflated version (99.99.100) under an internal-sounding name, consistent with a dependency-confusion resolution-override attempt against a private package of the same name. The shipped main.py defines CALLBACK_URL = "https://webhook.site/b961eb5e-fabc-43a5-83a3-d1509c3a558e" and performs an HTTP GET to that URL with a diagnostic-error query parameter when main() is invoked. The webhook.site endpoint is an anonymous third-party request-logging service typical of dependency-confusion canaries and reconnaissance beacons. The package has no install-time hook (no setup.py side effects, no build-backend network I/O) and the beacon does not fire on bare import — the init re-exports symbols that do not exist in main.py, so import zagents_message_bus raises ImportError before the GET runs. The beacon therefore only fires if a consumer explicitly calls main(). No credential reads, filesystem writes outside the package, or code execution of fetched content are present.

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• The package overrides the install command in setup.py to execute malicious code during installation.