privacypass-py 0.1.100

processes: 441
operations: 25K
packages: 0
compiler runs: 3
connections: 2
build time: 19s
job time: 19s
capture: 204 KB
records: 37K
bytes / record: 5.5

run 83dacfbf-286b-44c2-9ee3-5b13619b5a79 · built 2026-11-01 · complete View on PyPI Release

Reviewed by Bitbison: maliciousBuilding, installing or importing privacypass-py 0.1.99 to 0.1.101 sends the hostname, user, command lines and credential-like environment variables (AWS_, GITHUB_, PIP_, *TOKEN*, *SECRET*) to http://85.190.112.236:8881; the package has no other function.

Graph

egress · medium · in privacypass_py-0.1.100-py3-none-any.whl

Detections
Build script reached 85.190.112.236egress · medium · in privacypass_py-0.1.100-py3-none-any.whl
Artifacts
privacypass_py-0.1.100-py3-none-any.whlarchive · retained · retained 1

Checks

8 of 10 clear · 1 not checked ▲ Network activity

Build behavior▲✓✓✓✓✓○✓

Supply chain✓

Pipeline✓

Detections

Build script reached 85.190.112.236

85.190.112.236:8881 › 85.190.112.236:8881

medium

Detection

mediumwitnessed

Build script reached 85.190.112.236

Unexpected network connection

Subject: 85.190.112.236:8881
Destination: 85.190.112.236:8881
Reaches
Jobs: build-import
Rule: egress

Evidence

Connection outside the process’s allowed destinationscause
connection to 85.190.112.236:8881, opened by python
subject 85.190.112.236:8881
by /tmp/build-env-jlom4s5n/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…
What a build script's fetch becamesupport
184 files came down, reaching 19 more; nothing the build compiled, linked or ran
Connection opened by a build script or child processsupport
the opener is the build script at /tmp/build-env-jlom4s5n/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py get_requires_for_build_wheel /tmp/tmpscxlcjs9

In privacypass_py-0.1.100-py3-none-any.whl

Loading the graph

Processes

build-import

python›python

Ran: /tmp/build-env-jlom4s5n/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…
Invoked by: .venv/bin/python -m build --wheel --outdir dist .

Lineage · 2 processes

python.venv/bin/python -m build --wheel --outdir dist .2581
python/tmp/build-env-jlom4s5n/bin/python /home/runner/work/privacypass-py/privacypass-py/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py…2605

Remediation

The build script or a dependency connected to the network during the build. Nothing it downloaded was compiled, linked or run. Build the package from what the registry ships, or accept the download after reviewing it.

Network

2 peers

85.190.112.236:8881 privacypass-py's own build code · python3.14 · dogado GmbH · 184 files undeclared
files.pythonhosted.org:8080 the package manager · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem

Versions2	Risk	Vulns	Published
0.1.101	medium	none	21h ago
0.1.100			22h ago

Raw data

capture: 204 KB
records: 37,051
bytes per record: 5.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-01 · run 83dacfbf-286b-44c2-9ee3-5b13619b5a79

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

privacypass-py sends the host's identity and credential environment variables to a hardcoded IP at build and import

maliciousCovers 0.1.99, 0.1.100 and 0.1.101Reviewed by BitbisonUpdated 2026-11-01

Building, installing or importing privacypass-py 0.1.99 to 0.1.101 sends the hostname, user, command lines and credential-like environment variables (AWS_, GITHUB_, PIP_, *TOKEN*, *SECRET*) to http://85.190.112.236:8881; the package has no other function.

What it does

privacypass-py presents itself as "Privacy Pass client primitives (python)" and ships no cryptographic code. Its setup.py runs a beacon whenever the package is built or installed.

In a build of 0.1.100 and of 0.1.101, every PEP 517 hook process that ran the package's setup.py (get_requires_for_build_wheel and the hooks after it, nine processes in each build) opened a plain TCP connection to 85.190.112.236:8881 and sent data to it. That address belongs to dogado GmbH (AS8648). None of those processes looked a name up first: the address is written into the code.

The package's source, as Amazon Inspector's report to OpenSSF describes it:

What it collects: setup.py's _report() gathers the hostname, the username, the working directory, the command line, the parent process's command line (read from /proc/<ppid>/cmdline), and the names and values of environment variables with credential-like prefixes (AWS_, GITHUB_, PIP_ and others).
Where it sends it: it POSTs that as JSON to http://85.190.112.236:8881/b/<nonce>, over plain HTTP.
On import too: privacypass_py/__init__.py repeats the beacon on every import privacypass_py. It adds CLOUDFLARE_, SUPERTOKENS, HOME, USER and PATH, plus any variable whose name contains KEY, SECRET, TOKEN, PASS, CRED, PRIVATE, SEED, MNEMONIC, SIGNATURE, COOKIE, SESSION or AUTH, and sends it to http://85.190.112.236:8881/f/<nonce>. That path runs outside pip's build isolation.

A build in CI therefore hands whatever cloud, forge and registry tokens are in the environment to a server on a bare IP address.

Timeline

0.1.99 published on PyPI: 2026-11-01 03:11:44 UTC.
0.1.100 published: 2026-11-01 03:12:09 UTC.
0.1.101 published: 2026-11-01 03:50:52 UTC.
OpenSSF published MAL-2026-18435 (Amazon Inspector, then kam193): 2026-11-01 08:01 UTC.

What to do

If you installed or imported any release in an environment that held credentials, rotate them: cloud keys, forge tokens, registry tokens, and anything else exported into the environment. Look for connections to 85.190.112.236:8881 in egress logs.

Indicators

addresses: 85.190.112.236:8881
requests: http://85.190.112.236:8881/b/<nonce>http://85.190.112.236:8881/f/<nonce>