Malicious code in nagios-xi (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c11c80cc2d314460d61a649c84fd75881388470382be8183b77b362e562a5c7f) On `import nagios_xi`, the package's `__init__.py` (lines 5-8) invokes `socket.gethostbyname("atlass-check.autaeqjhfowvnnmkwhxjtq8x39d8nder1.oast.fun")` inside a silent try/except. oast.fun is ProjectDiscovery's Interactsh out-of-band callback service; the DNS query itself is the exfiltration channel, confirming code execution on the installer's host and leaking the resolver IP to whoever controls the unique 32-character Interactsh subdomain. The package ships no actual functionality — it impersonates the Nagios XI commercial monitoring product (name `nagios-xi`, version `19.5.0` mimicking real Nagios XI versioning) while declaring an anonymous ProtonMail author (`Coding Team <[email protected]>`), a generic `package utility` description, and an empty README. The combination of brand impersonation, placeholder metadata, and an import-time OAST beacon as the package's sole behavior is reconnaissance for a supply-chain attack against developers searching for Nagios XI integrations. ## Source: kam193 (d8b27c2588accf4f2966f4630a12f9bfdc4ba621403f14237160632447152f23) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.
AI Analysis
Technical Summary
This threat involves a malicious PyPI package named 'nagios-xi' that mimics the legitimate Nagios XI monitoring product by using similar version numbers and branding. The package's __init__.py file contains code that, when imported, silently performs a DNS lookup to a unique subdomain controlled by an attacker via ProjectDiscovery's Interactsh service. This DNS query acts as an out-of-band exfiltration channel, confirming code execution on the host and leaking the resolver IP address. The package declares an anonymous ProtonMail author and contains no actual monitoring functionality. It also overrides the install command to execute malicious code during installation. This behavior is reconnaissance aimed at supply-chain attacks against developers integrating Nagios XI.
Potential Impact
The package exfiltrates basic information about the host system, specifically the DNS resolver IP, upon import or installation. This confirms code execution on the host and leaks network information to an attacker-controlled domain. There is no indication of further payload or direct system compromise beyond this reconnaissance and data leakage. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until then, avoid installing or importing the 'nagios-xi' package from PyPI, especially versions 19.4.0 and 19.5.0. Verify package authenticity before use and prefer official sources for Nagios XI integrations. Monitor for and remove any instances of this malicious package in your environment.
Malicious code in nagios-xi (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c11c80cc2d314460d61a649c84fd75881388470382be8183b77b362e562a5c7f) On `import nagios_xi`, the package's `__init__.py` (lines 5-8) invokes `socket.gethostbyname("atlass-check.autaeqjhfowvnnmkwhxjtq8x39d8nder1.oast.fun")` inside a silent try/except. oast.fun is ProjectDiscovery's Interactsh out-of-band callback service; the DNS query itself is the exfiltration channel, confirming code execution on the installer's host and leaking the resolver IP to whoever controls the unique 32-character Interactsh subdomain. The package ships no actual functionality — it impersonates the Nagios XI commercial monitoring product (name `nagios-xi`, version `19.5.0` mimicking real Nagios XI versioning) while declaring an anonymous ProtonMail author (`Coding Team <[email protected]>`), a generic `package utility` description, and an empty README. The combination of brand impersonation, placeholder metadata, and an import-time OAST beacon as the package's sole behavior is reconnaissance for a supply-chain attack against developers searching for Nagios XI integrations. ## Source: kam193 (d8b27c2588accf4f2966f4630a12f9bfdc4ba621403f14237160632447152f23) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a malicious PyPI package named 'nagios-xi' that mimics the legitimate Nagios XI monitoring product by using similar version numbers and branding. The package's __init__.py file contains code that, when imported, silently performs a DNS lookup to a unique subdomain controlled by an attacker via ProjectDiscovery's Interactsh service. This DNS query acts as an out-of-band exfiltration channel, confirming code execution on the host and leaking the resolver IP address. The package declares an anonymous ProtonMail author and contains no actual monitoring functionality. It also overrides the install command to execute malicious code during installation. This behavior is reconnaissance aimed at supply-chain attacks against developers integrating Nagios XI.
Potential Impact
The package exfiltrates basic information about the host system, specifically the DNS resolver IP, upon import or installation. This confirms code execution on the host and leaks network information to an attacker-controlled domain. There is no indication of further payload or direct system compromise beyond this reconnaissance and data leakage. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until then, avoid installing or importing the 'nagios-xi' package from PyPI, especially versions 19.4.0 and 19.5.0. Verify package authenticity before use and prefer official sources for Nagios XI integrations. Monitor for and remove any instances of this malicious package in your environment.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5698
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba5668715ace4357ee9e
Added to database: 07/10/2026, 09:24:38 UTC
Last enriched: 07/10/2026, 09:42:15 UTC
Last updated: 07/30/2026, 02:28:02 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.