Cybersecurity researchers have flagged a malicious package deal on the Python Bundle Index (PyPI) repository that claims to supply the power to create a SOCKS5 proxy service, whereas additionally offering a stealthy backdoor-like performance to drop further payloads on Home windows methods.
The misleading package deal, named soopsocks, attracted a complete of 2,653 downloads earlier than it was taken down. It was first uploaded by a consumer named “soodalpie” on September 26, 2025, the identical date the account was created.
“Whereas offering this functionality, it displays habits as a backdoor proxy server focusing on Home windows platforms, utilizing automated set up processes by way of VBScript or an executable model,” JFrog mentioned in an evaluation.
The executable (“_AUTORUN.EXE”) is a compiled Go file that, apart from together with a SOCKS5 implementation as marketed, can be designed to run PowerShell scripts, set firewall guidelines, and relaunch itself with elevated permissions. It additionally carries out primary system and community reconnaissance, together with Web Explorer safety settings and Home windows set up date, and exfiltrates the data to a hard-coded Discord webhook.
“_AUTORUN.VBS,” the Visible Fundamental Script launched by the Python package deal in variations 0.2.5 and 0.2.6, can be able to operating a PowerShell script, which then downloads a ZIP file containing the reliable Python binary from an exterior area (“set up.soop[.]house:6969”) and generates a batch script that is configured to put in the package deal utilizing the “pip set up” command and run it.
The PowerShell script then invokes the batch script, inflicting the Python package deal to be executed, which, in flip, elevates itself to run with administrative privileges (if not already), configure firewall guidelines to permit UDP and TCP communication by way of port 1080, set up as a service, preserve communication with a Discord webhook, and arrange persistence on the host utilizing a scheduled process to ensure it robotically begins upon a system reboot.
“soopsocks is a well-designed SOCKS5 proxy with full bootstrap Home windows help,” JFrog mentioned. “Nevertheless, given the best way it performs and actions it takes throughout runtime, it reveals indicators of malicious exercise, akin to firewall guidelines, elevated permissions, varied PowerShell instructions, and the switch from easy, configurable Python scripts to a Go executable with hardcoded parameters, model with reconnaissance capabilities to a predetermined Discord webhook.”
The disclosure comes as npm package deal maintainers have raised issues associated to an absence of native 2FA workflows for CI/CD, self-hosted workflow help for trusted publishing, and token administration following sweeping modifications launched by GitHub in response to a rising wave of software program provide chain assaults, Socket mentioned.
Earlier this week, GitHub mentioned it should shortly revoke all legacy tokens for npm publishers and that every one granular entry tokens for npm can have a default expiration of seven days (down from 30 days) and a most expiration of 90 days, which was once limitless beforehand.
“Lengthy-lived tokens are a main vector for provide chain assaults. When tokens are compromised, shorter lifetimes restrict the window of publicity and scale back potential injury,” it mentioned. “This modification brings npm consistent with safety greatest practices already adopted throughout the trade.”
It additionally comes because the software program provide chain safety agency launched a free software known as Socket Firewall that blocks malicious packages at set up time throughout npm, Python, and Rust ecosystems, giving builders the power to safeguard their environments towards potential threats.
“Socket Firewall is not restricted to defending you from problematic top-level dependencies. It can additionally forestall the package deal supervisor from fetching any transitive dependency that’s recognized to be malicious,” the corporate added.
