dac-tools@999.0.0

Summary

On import of dac_tools, the top-level __init__.py executes whoami and hostname via subprocess, concatenates the results into a DNS label, and triggers socket.getaddrinfo against <label>.depconf-dac.dac2vlrk5gm3aemg9ptgq3kye1ky9kd4e.p.0xy.us, causing the installer's OS username and hostname to be transmitted to an attacker-controlled authoritative DNS server on every import. A second beacon in CDHApiClient.get_project_credentials_with_client_credentials performs a DNS lookup to cdh-intercept.depconf-dac.dac2vlrk5gm3aemg9ptgq3kye1ky9kd4e.p.0xy.us and returns fabricated AWS credentials, mimicking an internal cdh_api_client API surface so that any caller invoking the shim signals the attacker. The package name shadows an internal dependency and is published at version 999.0.0 to win resolution against the internal package - the canonical dependency-confusion shape.

Source: amazon-inspector (203490886d6928aee2c8d681d282f53d8513907b30be5e5e20fe1effb5fd21d2)