Skip to content
Open-Source Registry

pypi / privacypass-py

privacypass-py 0.1.101

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
443
operations
25K
packages
0
compiler runs
3
connections
2
build time
20s
job time
20s
capture
210 KB
records
38K
bytes / record
5.6

Privacy Pass client primitives (python)

published 2026-11-01 View on PyPI
Reviewed by Bitbison: maliciousBuilding, installing or importing privacypass-py 0.1.99 to 0.1.101 sends the hostname, user, command lines and credential-like environment variables (AWS_, GITHUB_, PIP_, *TOKEN*, *SECRET*) to http://85.190.112.236:8881; the package has no other function.

Graph

egress · medium · in privacypass_py-0.1.101-py3-none-any.whl
2

Checks

8 of 10 clear · 1 not checked Network activity
Build behavior▲✓✓✓✓✓○✓
Supply chain✓
Pipeline✓

Detections

1
  • Build script reached 85.190.112.236
    85.190.112.236:8881 › 85.190.112.236:8881
    medium

Detection

mediumwitnessed

Build script reached 85.190.112.236

Unexpected network connection

Subject
85.190.112.236:8881
Destination
85.190.112.236:8881
Reaches
Jobs
build-import
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 85.190.112.236:8881, opened by python

    subject 85.190.112.236:8881

    by /tmp/build-env-atxpi6ug/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…

  2. What a build script's fetch becamesupport

    184 files came down, reaching 19 more; nothing the build compiled, linked or ran

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /tmp/build-env-atxpi6ug/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py get_requires_for_build_wheel /tmp/tmp63a9ly8p

In privacypass_py-0.1.101-py3-none-any.whl

Loading the graph

Processes

build-import

python›python

Ran
/tmp/build-env-atxpi6ug/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…
Invoked by
.venv/bin/python -m build --wheel --outdir dist .
Lineage · 2 processes
  1. python.venv/bin/python -m build --wheel --outdir dist .2581
  2. python/tmp/build-env-atxpi6ug/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…2605

Remediation

The build script or a dependency connected to the network during the build. Nothing it downloaded was compiled, linked or run. Build the package from what the registry ships, or accept the download after reviewing it.

Network

2 peers
  • 85.190.112.236:8881 privacypass-py's own build code · python3.14 · dogado GmbH · 184 files undeclared
  • files.pythonhosted.org:8080 the package manager · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions2RiskVulnsPublished
0.1.101mediumnone21h ago
0.1.10021h ago

Raw data

capture
210 KB
records
37,877
bytes per record
5.6

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-01 · run 19acbc32-9274-4684-80cd-10b193f09193

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

privacypass-py sends the host's identity and credential environment variables to a hardcoded IP at build and import

maliciousCovers 0.1.99, 0.1.100 and 0.1.101Reviewed by BitbisonUpdated 2026-11-01

Building, installing or importing privacypass-py 0.1.99 to 0.1.101 sends the hostname, user, command lines and credential-like environment variables (AWS_, GITHUB_, PIP_, *TOKEN*, *SECRET*) to http://85.190.112.236:8881; the package has no other function.

What it does

privacypass-py presents itself as "Privacy Pass client primitives (python)" and ships no cryptographic code. Its setup.py runs a beacon whenever the package is built or installed.

In a build of 0.1.100 and of 0.1.101, every PEP 517 hook process that ran the package's setup.py (get_requires_for_build_wheel and the hooks after it, nine processes in each build) opened a plain TCP connection to 85.190.112.236:8881 and sent data to it. That address belongs to dogado GmbH (AS8648). None of those processes looked a name up first: the address is written into the code.

The package's source, as Amazon Inspector's report to OpenSSF describes it:

  • What it collects: setup.py's _report() gathers the hostname, the username, the working directory, the command line, the parent process's command line (read from /proc/<ppid>/cmdline), and the names and values of environment variables with credential-like prefixes (AWS_, GITHUB_, PIP_ and others).
  • Where it sends it: it POSTs that as JSON to http://85.190.112.236:8881/b/<nonce>, over plain HTTP.
  • On import too: privacypass_py/__init__.py repeats the beacon on every import privacypass_py. It adds CLOUDFLARE_, SUPERTOKENS, HOME, USER and PATH, plus any variable whose name contains KEY, SECRET, TOKEN, PASS, CRED, PRIVATE, SEED, MNEMONIC, SIGNATURE, COOKIE, SESSION or AUTH, and sends it to http://85.190.112.236:8881/f/<nonce>. That path runs outside pip's build isolation.

A build in CI therefore hands whatever cloud, forge and registry tokens are in the environment to a server on a bare IP address.

Timeline

  • 0.1.99 published on PyPI: 2026-11-01 03:11:44 UTC.
  • 0.1.100 published: 2026-11-01 03:12:09 UTC.
  • 0.1.101 published: 2026-11-01 03:50:52 UTC.
  • OpenSSF published MAL-2026-18435 (Amazon Inspector, then kam193): 2026-11-01 08:01 UTC.

What to do

If you installed or imported any release in an environment that held credentials, rotate them: cloud keys, forge tokens, registry tokens, and anything else exported into the environment. Look for connections to 85.190.112.236:8881 in egress logs.

Indicators

addresses
85.190.112.236:8881
requests
http://85.190.112.236:8881/b/<nonce>http://85.190.112.236:8881/f/<nonce>

Links