On: Malicious software libraries found in PyPI posing ...

[thearn4]

It looks like the code phones home to a server in China:

IP: 121.42.217.44 Decimal: 2032851244 Hostname: 121.42.217.44 ASN: 37963 ISP: Hangzhou Alibaba Advertising Co.,Ltd. Organization: Hangzhou Alibaba Advertising Co.,Ltd. Services: None detected Type: Broadband Assignment: Static IP Blacklist: Click to Check Blacklist Status Continent: Asia Country: China cn flag State/Region: Zhejiang City: Hangzhou Latitude: 30.2936 (30° 17′ 36.96″ N) Longitude: 120.1614 (120° 9′ 41.04″ E)

[sdiepend → thearn4]

When you go this adress http://121.42.217.44:8080/

"Hi bro :)

Welcome Here!

Leave Messages via HTTP Log Please :)"

[raverbashing → thearn4]

I wonder what would happen if the return payload had some data that would trigger the GFoC