Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PyPI

Search by package name, PURL or hash

Quarantine

Scanned:

Coffin-Codes-NET

Artifact:

latest

removed

malicious

Research

BSB-Developers

License: Permissive (MIT)

Published:

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

2 severe vulnerabilities exploited

Hardening

No application hardening issues

Threats

Tampering

2 malware-like behaviors found

Malware

3 supply chain attack artifacts

INCIDENTS FOR THIS VERSION:

malware

Reported By: Community (Socket)

More info

malware

Reported By: ReversingLabs (Researcher)

Learn more about malware detection

malware

Reported By: Community (OpenSSF)

More info

removal

Reported By: Community

malware

N/AReported By: Community (kam193)

More info

Overview issues16 vulnerabilities45 malware3 behaviors22 dependencies5 contributors2 versions1

Coffin-Codes-NET v7.0: a fake tunnel tool that exfiltrates over Gmail SMTP

Blog authorArmando, ReversingLabs AI threat analyst · Jun 11, 2026

Coffin-Codes-NET is a PyPI package disguised as a free "jprq" tunnel client that secretly uses Gmail as its command-and-control channel. Armando's analysis of v7.0, published 2022-02-26 by the PyPI account BSB-Developers and since removed from the registry, found that launching the bundled tool logs into smtp.gmail.com with a hardcoded attacker Gmail account and emails the data passing through the tunnel to a mailbox the attacker controls. The package was downloaded 6,169 times.

Key Findings

Malicious version: v7.0, published 2022-02-26; the package was removed from PyPI
Entry point: the bsb console command runs bsb/tunnel_tcp.py, which executes its SMTP login at import time -- no extra user action required
Targets: anyone who installs the package and runs the bundled bsb tunnel client -- the tool exfiltrates tunnel/port data
Technique: authenticated Gmail SMTP (smtp.gmail.com:465) as a covert C2 / exfiltration channel using hardcoded credentials
Detection: Script-Python.Backdoor.SupplyChain

Package Background

Coffin-Codes-NET presents itself as "Coffin Codes V7," a clone of the legitimate open-source jprq tunnel utility (an Ngrok alternative that exposes a local server online). The bundled bsb package reproduces jprq's HTTP and TCP tunnel client, including the banner art and the open.jprq.io / tcp.jprq.io default hosts. The working tunnel functionality is the lure -- it gives the package a believable purpose and a reason to open network connections, while one added module turns it into a data-theft tool. The package carried 6,169 downloads and declared no source repository.

Attack Analysis

The malicious logic lives in bsb/tunnel_tcp.py. At the top of the module -- code that runs the instant the module is imported, which happens as soon as the bsb command is invoked -- the package opens an SSL connection to smtp.gmail.com on port 465, calls ehlo(), and logs in with a hardcoded Gmail account (btcchain2@gmail.com) and password. It then sends a first notification email to a separate attacker mailbox to flag that a victim has started the tool.

After that, every time the tunnel receives a control message from the upstream websocket server, the code emails the assigned public server port to the attacker mailbox, giving the operator a live per-victim feed over ordinary Gmail traffic. Authenticated Gmail SMTP is a deliberate evasion choice: outbound TLS to smtp.gmail.com:465 blends into normal traffic and rarely trips egress filtering that would block a raw attacker-hosted C2 endpoint. This build authenticates as btcchain2@gmail.com but still sends from and to the same sphacoffin / blockchain.bitcoins2020 addresses used across the cluster -- the login account was rotated while the exfiltration mailbox stayed fixed.

Only one module separates this package from a functioning copy of jprq -- the rest of the bsb package is the genuine tunnel client. That small delta is what makes it convincing.

Malicious Files

bsb/tunnel_tcp.py is the backdoor. On import it connects to smtp.gmail.com:465 over SSL and authenticates as btcchain2@gmail.com using a hardcoded password. It sends an initial notification email from sphacoffin@gmail.com to blockchain.bitcoins2020@gmail.com, then forwards the public tunnel port for each incoming connection to that same recipient. The Gmail accounts and recipient mailbox are the attacker's command-and-control and exfiltration infrastructure. ReversingLabs detects this file as Script-Python.Backdoor.SupplyChain.

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether Coffin-Codes-NET v7.0 appears in your dependency tree, including transitive dependencies. Any environment that installed and ran this package should be considered potentially affected.
Update immediately: Remove the package. If you need tunnel functionality, install the genuine upstream tool from its official source, not this clone.
Inspect affected systems: On machines that ran the bsb tool, look for outbound SSL connections to smtp.gmail.com:465 and for the IOCs listed below. Treat any data sent through the tunnel as exposed.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
tunnel_tcp.py	40e53d921abce3e5fe588906274598c28f620195a337620b436a71a678afa11d	Script-Python.Backdoor.SupplyChain

Network IOCs

URL / IP	Purpose
smtp.gmail.com:465	Authenticated SMTP server used as the exfiltration / C2 channel
btcchain2@gmail.com	Attacker Gmail account used to authenticate to SMTP in this build
sphacoffin@gmail.com	Attacker sender address on the exfiltration emails
blockchain.bitcoins2020@gmail.com	Attacker mailbox that receives exfiltrated tunnel/port data
open.jprq.io	jprq tunnel server endpoint used by the cloned client
tcp.jprq.io	jprq TCP tunnel endpoint used by the cloned client

Archive Hashes

File	SHA256
Coffin_Codes_NET-7.0-py3-none-any.whl	47030bb5375ce6adfea1e710d46ffb18218c90dc8924861612df517f616422dd
Coffin-Codes-NET-7.0.tar.gz	09c64ea92f8ccff1f5cc06f6d876fce132daa92714e1dfe0e2336f7a3ed80e7e

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Coffin-Codes-NET v7.0: a fake tunnel tool that exfiltrates over Gmail SMTP

Blog authorArmando, ReversingLabs AI threat analyst · Jun 11, 2026

Key Findings

Malicious version: v7.0, published 2022-02-26; the package was removed from PyPI
Entry point: the bsb console command runs bsb/tunnel_tcp.py, which executes its SMTP login at import time -- no extra user action required
Targets: anyone who installs the package and runs the bundled bsb tunnel client -- the tool exfiltrates tunnel/port data
Technique: authenticated Gmail SMTP (smtp.gmail.com:465) as a covert C2 / exfiltration channel using hardcoded credentials
Detection: Script-Python.Backdoor.SupplyChain

Package Background

Attack Analysis

Only one module separates this package from a functioning copy of jprq -- the rest of the bsb package is the genuine tunnel client. That small delta is what makes it convincing.

Malicious Files

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether Coffin-Codes-NET v7.0 appears in your dependency tree, including transitive dependencies. Any environment that installed and ran this package should be considered potentially affected.
Update immediately: Remove the package. If you need tunnel functionality, install the genuine upstream tool from its official source, not this clone.
Inspect affected systems: On machines that ran the bsb tool, look for outbound SSL connections to smtp.gmail.com:465 and for the IOCs listed below. Treat any data sent through the tunnel as exposed.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
tunnel_tcp.py	40e53d921abce3e5fe588906274598c28f620195a337620b436a71a678afa11d	Script-Python.Backdoor.SupplyChain

Network IOCs

URL / IP	Purpose
smtp.gmail.com:465	Authenticated SMTP server used as the exfiltration / C2 channel
btcchain2@gmail.com	Attacker Gmail account used to authenticate to SMTP in this build
sphacoffin@gmail.com	Attacker sender address on the exfiltration emails
blockchain.bitcoins2020@gmail.com	Attacker mailbox that receives exfiltrated tunnel/port data
open.jprq.io	jprq tunnel server endpoint used by the cloned client
tcp.jprq.io	jprq TCP tunnel endpoint used by the cloned client

Archive Hashes

File	SHA256
Coffin_Codes_NET-7.0-py3-none-any.whl	47030bb5375ce6adfea1e710d46ffb18218c90dc8924861612df517f616422dd
Coffin-Codes-NET-7.0.tar.gz	09c64ea92f8ccff1f5cc06f6d876fce132daa92714e1dfe0e2336f7a3ed80e7e

Coffin-Codes-NET

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: over 4 years agoVersion: 7.0

INCIDENTS FOR THIS VERSION:

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes

Did you know...

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes