{"schema_version":"1.9.2","id":"MAL-2026-18706","published":"2026-11-05T12:29:01Z","modified":"2026-11-12T00:45:06.754525270Z","summary":"Malicious code in mcp-teamviewer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (108ea237ed659c21bd0e896db8184187b0c6e34b07d1c7659365db70e8857551)\nOn import of the top-level mcp_teamviewer module, the package constructs a DNS label from the installer's USER/USERNAME, hostname (platform.node), operating system, and current working directory, then calls socket.getaddrinfo() against that label as a subdomain of oast.me (an out-of-band interact collector). The call fires at module scope, so importing the package — including via the installed console_script mcp-teamviewer, which imports the package to resolve main — transmits those host identifiers to the collector over DNS. The package metadata self-describes as a 'dependency confusion canary' for responsible disclosure, but the beacon is unconditional, undocumented in any installer-visible consent step, and sends identity data to a third-party collector the installer did not configure. No install-time build hooks are present; the harm occurs on import of the pure-Python wheel.\n\n## Source: kam193 (54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff)\nThe OpenSSF Package Analysis project identified 'mcp-teamviewer' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"mcp-teamviewer","ecosystem":"PyPI","purl":"pkg:pypi/mcp-teamviewer"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["mcp_teamviewer-0.0.1.tar.gz","mcp_teamviewer-0.0.1-py3-none-any.whl"],"path":"src/mcp_teamviewer/__init__.py","sha256":"edb5d8fb2311ec004137bd50633afb6743a78db172b5705756baa306c1669beb","tlsh":"fd21dd245e201d72974f055d9c161901053f6d6347be7858f98e0ed89fa9a76e061d38"},{"artifacts":["mcp_teamviewer-0.0.1.tar.gz"],"path":"pyproject.toml","sha256":"bfd750d9b9050306a127f3a5bac0c016299bad24cc5812e3441deb59c662dccd","tlsh":"22f05c769903b475deaf505098b40706e8b5701af1c0755af28f8144a00ded5e7e2436"}],"package_integrity":[{"filename":"mcp_teamviewer-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"a690b60ad41660b9aa6d886b234e606cb57c067b954d0273f7970ba7a16e84ea","md5":"9118b202aa81f9c0d555376908d5811a","sha256":"8ec23cf764613507a47345bc8b3df04754596826c7317e93ef230f8e56ec894c"}},{"filename":"mcp_teamviewer-0.0.1.tar.gz","hashes":{"blake2b_256":"9831666bcfc5057861406bdd0e2a833dd5ef147266995d9f453ce76212820426","md5":"23647344379181c305bffa6f2e6e1817","sha256":"d226d40b1b6212e914c1e78983d57cd316cd1780c40d508f6b2614a62d184cba"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/mcp-teamviewer/MAL-2026-18706.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/mcp-teamviewer"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp-teamviewer/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T12:38:33.75810882Z","modified_time":"2026-11-05T12:29:01Z","sha256":"a5d59e94208df065ea45c96e99b262462ea08b134b85f9d1f707f4350623d7ff","source":"ossf-package-analysis","versions":["0.0.1"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/mcp-teamviewer","import_time":"2026-11-05T17:12:13.236661279Z","modified_time":"2026-11-05T16:35:02.511643Z","sha256":"54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e","source":"kam193","versions":["0.0.1"]},{"id":"IN-MAL-2026-022625","import_time":"2026-11-12T00:30:24.824714125Z","modified_time":"2026-11-11T23:47:25Z","sha256":"108ea237ed659c21bd0e896db8184187b0c6e34b07d1c7659365db70e8857551","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}