Malicious code in captcha-solve-api (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee)

The package advertises itself as a REST client for a captcha-solving API, but the shipped captcha_solve_api module is a ~20-line stub. The tarball's real payload is two top-level modules (_telemetry_init, _telemetry_transport, ~117 KB) installed as global site modules together with a telemetry.pth file copied into site-packages by a custom install command. The.pth contains import _telemetry_init, which Python auto-executes on every interpreter start — independent of whether captcha_solve_api is ever imported. _telemetry_init spawns a daemon thread that instantiates _telemetry_transport.Client and calls initialize()/track(). The runtime collects host identifiers (platform.node() hostname, cpu_count, OS/arch, Python version, session identifiers) and POSTs JSON envelopes to /api/envelope on a destination host that is not hardcoded: a ServiceDiscovery class issues DNS TXT queries to 8.8.8.8 and 1.1.1.1 and base64-decodes concatenated TXT chunks to reconstruct the endpoint, allowing the operator to rotate destinations after install and evade domain/IP allowlists. Author metadata is a generic placeholder ('Platform Engineering') and the DSN docstring uses [email protected]. The 'telemetry'/'analytics SDK' framing does not match the advertised captcha-solving purpose and is not part of the captcha_solve_api namespace.

Affected packages

• captcha-solve-api

Remediation

Refer to the advisory for the patched release.