MalwarePublished 14 Jul 2026

proxy-checker-j (PyPI) · Malicious Code

Affects proxy-checker-jSource GCVE Database

Malicious package : remove proxy-checker-j and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:56 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10644

What to do

Remove proxy-checker-j from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIproxy-checker-j	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'proxy-checker-j' version 0.1.0 contains a malicious payload disguised as a proxy checker tool. Instead of its advertised functionality, it installs a Go SSH daemon ('qsshd') that opens a persistent reverse SSH tunnel to a relay controlled by the attacker. This backdoor allows full interactive shell access, arbitrary command execution, and port forwarding to any party possessing a hardcoded private key. The daemon establishes persistence by creating device identity files on the host, enabling remote access across system restarts and through NAT/firewalls.

Impact

An attacker controlling the private key matching the embedded public key can gain full interactive shell access, execute arbitrary commands, and perform TCP port forwarding on the compromised host. The reverse tunnel bypasses NAT and firewall restrictions, enabling persistent remote access. This effectively compromises the confidentiality, integrity, and availability of the affected system.

Defensive guidance

Users should immediately uninstall the 'proxy-checker-j' package version 0.1.0 and remove any related files such as '~/.config/.device_lock', '/dev/shm/.device_lock', and '/tmp/.device_lock'. Monitor for any unauthorized SSH tunnels or unusual network connections to unknown relays. Avoid installing packages from untrusted sources and verify package authenticity before installation. Check the vendor or PyPI advisories for any updates or official guidance.

Summary

The 'proxy-checker-j' package (version 0.1.0) published on PyPI includes a malicious Go SSH daemon that creates a reverse tunnel to an attacker-controlled relay. The daemon listens locally for SSH connections authorized by a single embedded ed25519 public key, granting the attacker full shell and command execution capabilities, as well as TCP port forwarding. Persistence is achieved by writing device identity files to multiple locations on the host. This design allows the attacker to bypass network restrictions and maintain durable remote access under the guise of a proxy checking tool.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:56 UTC

Technical details

References

Community reviews