MalwarePublished 29 Oct 2026

poc-revshell (PyPI) · Malicious Code

Affects poc-revshellSource GCVE Database

Malicious package : remove poc-revshell and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18378

What to do

Remove poc-revshell from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIpoc-revshell	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The poc-revshell package version 0.1.0 on PyPI contains a reverse-shell backdoor that activates both during installation and import. It opens a TCP connection to localhost on port 4444, providing an interactive shell to any local listener. This backdoor runs with the installing user's privileges and is confined to local attackers on the same host.

Impact

An attacker with local access to the victim's machine and listening on port 4444 can gain an interactive shell with the privileges of the user installing or importing the package. This allows execution of arbitrary commands locally, potentially leading to privilege escalation or lateral movement within the host. The attack is limited to local adversaries due to the hardcoded loopback address.

Defensive guidance

Users should avoid installing or importing poc-revshell 0.1.0. Remove the package if already installed. Monitor local network ports for unexpected listeners on 127.0.0.1:4444. Use trusted sources and verify package integrity before installation.

Summary

The poc-revshell 0.1.0 package includes malicious code that launches a reverse shell backdoor at install time via a custom install command and again at import time via module initialization. The backdoor opens a TCP socket to 127.0.0.1:4444 and redirects standard input/output to a shell process, allowing any local listener on that port to gain an interactive shell with the installing user's permissions. The hardcoded loopback address limits the attack to local adversaries co-resident on the host. This behavior matches the package's self-description as a proof-of-concept reverse shell triggered on pip install.

References

pypi.org/project/poc-revshell/0.1.0/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:52 UTC

Technical details

References

Community reviews