What we caught on 4 November
The PyPI account ram624417 published msgpackrpc 0.0.0 as an empty placeholder. Version 0.1.0 followed. It adds one file, setup.py, and an empty library. Vigilance flagged the release 34 seconds after publication. The new file can do two things that the old version cannot. It reads who the machine is, and it sends that out.
- It runs at install. The file replaces pip's install step with its own. You do not need to import or run anything.
- It reads the machine. It takes the computer name and the IP address that the name resolves to.
- It sends them out. It posts them to a fixed
webhook.siteaddress, a public service that lets anyone collect web requests. - It hides failure. The file catches and drops every error. The install looks normal.
The package describes itself as POC package (beacon-only). It sends no passwords and no files. When we found it, OSV and the OpenSSF malicious-packages list had no entry for it (of course not, because it only existed for less than a minute). We reported it to PyPI the same morning.
What bounty farming is
Many companies keep private packages with plain names. If a company sets up its build badly, pip can take a public package with the same name in place of the private one. Security teams call that mistake dependency confusion.
Bounty farming uses that mistake for money. Someone publishes a public package under a name that a company uses privately. The package reports back when it installs. The computer name and IP address show which company took it. The publisher then asks that company for a bug bounty. The msgpackrpc package fits this pattern. The name matches the import name of the msgpack-rpc-python library. The package reports only what identifies the machine.
The code runs before anyone agrees. A bounty program covers testing that a company asks for. A public package reaches every machine that installs it: companies with no bounty program, students, build servers and AI agents that pick packages on their own.
Why intent does not change the verdict
We cannot see intent. We can see what a file does. This file runs at install, collects data that identifies the machine, and sends it to an address that the user did not set. An attacker who wants a target list runs the same first step and ships the harmful version later. From the files, the two cases look the same.
So Vigilance gives one verdict: attack. A label like POC or research in the package description does not lower it.
One page, two answers
ReversingLabs scans public packages and shows the results on its Spectra Assure Community site. Its page for msgpackrpc gives a scan time of 10:59 UTC, 11 minutes after publication. Vigilance flagged the release at 10:48 UTC. The same page holds two answers about the same package, and they do not agree.
The rule checks are right. Eight policies fire. Four of them describe what the code does, and all four match setup.py:
- TH16604: an installer that can collect sensitive system information
- TH15501: behavior similar to malicious packages published on PyPI
- TH15103: behavior commonly used by malicious software
- TH17131: a domain used to catch and inspect HTTP requests
One more, TH30102, reports the package as quarantined. The other three are about age and reputation: recently published, rarely used, and no source repository. Those are true here, but they are true for almost every new package too.
The AI summary is wrong. On the same page, an AI code summary concludes that the package shows "no strong malicious indicators". When we read the page on 4 November 2026, it got three facts wrong:
- It describes code that does not exist. It says the core library gives serialization tools. The library file is empty.
- It calls the beacon normal. It says that sending host data to a webhook at install is "a common pattern for telemetry". The address is a public request catcher on
webhook.site. Anyone can make one in seconds. - It clears the data. It says the hostname and IP are "not classified as sensitive". Those two values identify the machine and its network.
A source that disagrees with itself cannot be the one you trust. The rules say quarantine. The summary says normal install behavior. A developer, or an AI agent, that reads only the summary installs the package. Vigilance gives one answer, from the files: this file gained a power the old version did not have.
What to do about it
Do this now
- Claim your private package names on the public registry
- Point each private name at your own registry only
- Pin versions, and install with hashes
Do not rely on this
- A "POC" or "research" label in the package
- Reputation scores. The account was ten days old
- Malware lists. OSV had no entry when it went live
- An AI summary. One called this package clean
Vigilance compares the new version with the old one and shows the one file that gained a real power. Here, one file went from nothing to sending the machine's name and IP address to a stranger at install.
About Vigilance
Modul4r Solutions, in Edmonton, Alberta, Canada, makes Vigilance. Vigilance protects the computers where your team builds software with AI tools. It catches a package update that gains a harmful power, before any list knows about it, and swaps it for the last safe version.