Skip to content
Open-Source Registry

pypi / h13t0ry-hello-demo / 0.1.0

h13t0ry-hello-demo 0.1.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
417
operations
22K
packages
0
compiler runs
3
connections
2
build time
39s
job time
39s
capture
190 KB
records
34K
bytes / record
5.5

Build behaviourcompiled and nothing more

run 4b7ec5b1-3c9f-4c65-adb3-807237f8e63c · built 2026-10-27 · complete View on PyPI
Reviewed by Bitbison: maliciousImporting hello_demo opens a TCP connection to a hardcoded IP (115.190.210.22:80) and relays an interactive /bin/bash over it; in the registry build the remote operator ran `env`, which dumps the job's environment and credentials. Do not install or import.

Graph

remote-control · critical
2

Checks

11 of 12 clear Network activity
Build behavior▲✓✓✓✓✓✓✓✓
Supply chain✓✓
Pipeline✓

Detections

1
  • Shell ran commands from 115.190.210.22:80: env
    bash › 115.190.210.22:80
    critical

Detection

criticalwitnessed

Shell ran commands from 115.190.210.22:80: env

Shell driven over the network

Subject
/usr/bin/bash
Destination
115.190.210.22:80
Jobs
build-import
Rule
remote-control · h13t0ry-hello-demo

Evidence

  1. Shell driven over the networkcause

    bash took its input from 115.190.210.22:80 through python, which sent its output back

    target 115.190.210.22:80

    by /bin/bash

  2. Relay between the peer and the shellsupport

    python passed what 115.190.210.22:80 sent to bash and sent its output back

    target 115.190.210.22:80

    by /home/runner/work/h13t0ry-hello-demo/h13t0ry-hello-demo/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = fai…

  3. Command the driven shell ransupport

    ran env

    by env

What came before it

Loading the graph

Processes

build-import

python›python›bash

Ran
/bin/bash
Invoked by
.venv/bin/python /home/runner/work/_temp/imports.py h13t0ry-hello-demo
Lineage · 3 processes
  1. python.venv/bin/python /home/runner/work/_temp/imports.py h13t0ry-hello-demo2498
  2. python/home/runner/work/h13t0ry-hello-demo/h13t0ry-hello-demo/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = fai…2500
  3. bash/bin/bash2501

Remediation

Treat the machine as controlled by that peer for as long as the job ran: find the code that opened the connection and started the shell, and rotate every credential the job could reach.

Network

2 peers
  • files.pythonhosted.org:8080 the package manager · python3.14 (h13t0ry-hello-demo) via Package registries profile (pip → files.pythonhosted.org) ecosystem
  • 115.190.210.22:80 h13t0ry-hello-demo's own build code · python3.14 (h13t0ry-hello-demo) · Beijing Volcano Engine Technology Co., Ltd. unjudged
Versions1RiskVulnsPublished
0.1.0criticalnone2d ago

Raw data

capture
190 KB
records
34,434
bytes per record
5.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-10-29 · run 4b7ec5b1-3c9f-4c65-adb3-807237f8e63c

analysis 0.1.0 · 2026-10-29 · 9ed17fc · graph v2

Reverse shell on import to 115.190.210.22:80

maliciousCovers 0.1.0Reviewed by BitbisonUpdated 2026-10-29

Importing hello_demo opens a TCP connection to a hardcoded IP (115.190.210.22:80) and relays an interactive /bin/bash over it; in the registry build the remote operator ran `env`, which dumps the job's environment and credentials. Do not install or import.

Evidence from the registry's capture of run 4b7ec5b1-3c9f-4c65-adb3-807237f8e63c (job build-import, stream b8479129-cbde-4ceb-91c0-28d10509cf77), 2026-10-27 UTC:

  • Install and build ran clean. pip install, python -m build --wheel and pip install --editable . (00:27:25–00:27:35) reached only the PyPI mirror and ran nothing unusual. The payload runs at import time, not install time.
  • 00:27:35.29: the import harness (importlib.import_module('h13t0ry-hello-demo')) loads hello_demo.py.
  • 00:27:35.49: that python process forks, and the child execs /bin/bash. The shell is interactive: it reads /etc/bash.bashrc, ~/.bashrc, bash-completion and /etc/inputrc.
  • 00:27:35.52: the parent python process opens 10.0.2.15 → 115.190.210.22:80 over TCP. No DNS lookup precedes the connection, so the IP is hardcoded. From then on python relays between the socket and bash's stdio in both directions (3 writes and 2 reads on the socket, matching reads and writes on bash's pipes).
  • 00:27:35.85: bash forks and runs env, and its output goes back over the socket. Every environment variable of the job, including CI tokens if any are present, was sent to the peer.
  • 00:28:03.09: the session ends. bash writes ~/.bash_history on exit and the import step returns. The import blocked for about 28 s while the session was open.

Tarp rated this remote-control (Shell driven over the network), critical, confidence witnessed. The process tree and socket edges above confirm it end to end. The package has no source repository, license, homepage or publisher metadata, and its description is "A simple Python package". This is a disguised reverse shell. It is not a documented feature.

Remediation for anyone who imported it: treat the host as remotely controlled for the life of that process, rotate every credential in its environment or reachable from it, and block 115.190.210.22.

Indicators

behaviors
import-time fork+exec /bin/bash with stdio relayed to an outbound TCP socketran env over the remote shell
files
hello_demo.py
ipv4
115.190.210.22
ports
80

Links