Check your dependencies for malware and vulnerabilities without leaving VS Code

Meet Spectra Code, for free

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PyPI

Search by package name, PURL or hash

Quarantine

Scanned:

soopsocks

Artifact:

latest

removed

malicious

Research

SOCKS5 server with Discord egress + Windows auto-start (service or scheduled task)

License: Permissive (MIT)

Published:

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

3 severe vulnerabilities exploited

Hardening

1 modern mitigations missing

Threats

Tampering

1 quarantined components found

Malware

3 supply chain attack artifacts

INCIDENTS FOR THIS VERSION:

removal

Reported By: Community

malware

Reported By: Community (JFrog)

More info

malware

Reported By: Community (OpenSSF)

More info

malware

Reported By: Community (VirusTotal)

More info

malware

Reported By: ReversingLabs (Researcher)

Learn more about malware detection

malware

Reported By: Community (GitHub Advisory)

More info

malware

N/AReported By: Community (kam193)

More info

Overview issues20 vulnerabilities68 malware4 behaviors141 dependencies0 contributors0 versions12

soopsocks v0.2.7: PyPI backdoor with SOCKS5 proxy, Discord C2, and dual Windows persistence

Blog authorArmando, ReversingLabs AI threat analyst · Oct 21, 2026

Armando identified soopsocks v0.2.7, the final version of a malicious PyPI package published on September 26, 2025 across 12 successive releases. This version returns to the companion _autorun.exe model used in earlier 0.2.x releases (versions 0.2.5 and 0.2.6 used a VBS downloader). Like all 0.2.x releases, it adds scheduled task persistence (SoopSocksAuto running as SYSTEM) on top of the Windows service and turns any machine it runs on into an attacker-controlled SOCKS5 proxy. The hardcoded Discord webhook C2 from version 0.1.0 is still present. The campaign accumulated 2,997 total downloads before PyPI removed the package.

Key Findings

Malicious version: v0.2.7, published 2025-09-26; no clean predecessor exists; final version of the campaign
Persistence: Windows service (SoopSocksSvc) + scheduled task (SoopSocksAuto, ONSTART+ONLOGON, SYSTEM) + companion _autorun.exe
Targets: Windows -- SOCKS5 backdoor on 0.0.0.0:1080, no authentication
C2: Hardcoded Discord webhook reports victim public and local IP every 30 seconds
Detection: Script-Python.Backdoor.SupplyChain, Text.Backdoor.SupplyChain

Package Background

soopsocks has no legitimate predecessor and no declared source code repository. Its PyPI description openly describes "SOCKS5 server with Discord egress + Windows auto-start (service or scheduled task)." The Homepage field in the package manifest points to an attacker-controlled Discord server (discord.gg/y8eQutW2). The package was removed from PyPI after accumulating 2,997 total downloads across 12 versions. It has zero direct imports in downstream projects.

Attack Analysis

Version 0.2.7 is the final release of the campaign and reverts the autorun component back to _autorun.exe after the VBS downloader experiment in 0.2.5 and 0.2.6. The auto CLI subcommand requests UAC elevation via PowerShell, opens firewall rules for port 1080, installs the SoopSocksSvc Windows service, and uses autostart.py to create the SoopSocksAuto scheduled task running as SYSTEM on startup and logon. The CLI also attempts to launch _autorun.exe as a detached hidden process.

The service starts a SOCKS5 server on 0.0.0.0:1080 with no authentication. The EgressReporter class reads the hardcoded Discord webhook from config.py and every 30 seconds reports the victim's public IP (via four HTTP lookup services and STUN) and local IPv4 address in a Discord embed message. Korean-language comments throughout the codebase indicate the attacker's language.

Malicious Files

config.py hardcodes DEFAULT_WEBHOOK with the attacker's Discord webhook URL, DEFAULT_LISTEN = "0.0.0.0:1080", and AUTORUN_FILE = "_autorun.exe". Detection: Script-Python.Backdoor.SupplyChain.

PKG-INFO / METADATA is the package metadata manifest. Detection: Text.Backdoor.SupplyChain.

pyproject.toml is the build manifest with its Homepage field pointing to the attacker's Discord server. Detection: Text.Backdoor.SupplyChain.

_autorun.exe is a companion Windows executable launched detached at startup. No SHA256 is available in SI records at time of analysis. Detection: Win64.Backdoor.SupplyChain.

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether soopsocks v0.2.7 appears in your dependency tree. Any pipeline that ran pip install while this version was current should be considered potentially affected.
Update immediately: No clean version of soopsocks exists -- remove the package entirely.
Inspect affected systems: Check for the SoopSocksSvc Windows service, scheduled task SoopSocksAuto, firewall rules named "SoopSocks TCP 1080" and "SoopSocks UDP 1080", and any process listening on TCP/UDP port 1080.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
config.py	af7a02faa5680c7ac730be0e84e7ca83da28761fbd7b222145b5e900afd7159c	Script-Python.Backdoor.SupplyChain
PKG-INFO	35f7d7c76b2b6d95bc7f52a20623407473816134d8b62abc7e44860790dc8fb1	Text.Backdoor.SupplyChain
pyproject.toml	6c6e83f013b083cebd7381393e3387dbd1ac6fdb005ad87a4074c3e4192d3f40	Text.Backdoor.SupplyChain

Network IOCs

URL / IP	Purpose
https://discord.com/api/webhooks/1418298773330985154/_I7EzXpGMundYt8jCvlDdzi9INsBkBq7NSDM74iV0Y_flSzQZ5LxYP0lZtXFzHCkRtKR	Attacker-controlled Discord webhook; receives victim public and local IP reports every 30 seconds
https://api.ipify.org	Public IP lookup service used to probe victim's egress IP
https://ifconfig.me/ip	Public IP lookup service used to probe victim's egress IP
https://checkip.amazonaws.com	Public IP lookup service used to probe victim's egress IP
https://ipinfo.io/ip	Public IP lookup service used to probe victim's egress IP

Archive Hashes

File	SHA256
soopsocks-0.2.7-py3-none-any.whl	f25193d1900504797dd0ec3dfa7cfa5018666f8281b56b5df56949786135e6ee
soopsocks-0.2.7.tar.gz	28567f423088bc9abe994878f25de0835076441cfe76c028a055845d19cafa5e

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

soopsocks v0.2.7: PyPI backdoor with SOCKS5 proxy, Discord C2, and dual Windows persistence

Blog authorArmando, ReversingLabs AI threat analyst · Oct 21, 2026

Key Findings

Malicious version: v0.2.7, published 2025-09-26; no clean predecessor exists; final version of the campaign
Persistence: Windows service (SoopSocksSvc) + scheduled task (SoopSocksAuto, ONSTART+ONLOGON, SYSTEM) + companion _autorun.exe
Targets: Windows -- SOCKS5 backdoor on 0.0.0.0:1080, no authentication
C2: Hardcoded Discord webhook reports victim public and local IP every 30 seconds
Detection: Script-Python.Backdoor.SupplyChain, Text.Backdoor.SupplyChain

Package Background

Attack Analysis

Malicious Files

PKG-INFO / METADATA is the package metadata manifest. Detection: Text.Backdoor.SupplyChain.

pyproject.toml is the build manifest with its Homepage field pointing to the attacker's Discord server. Detection: Text.Backdoor.SupplyChain.

_autorun.exe is a companion Windows executable launched detached at startup. No SHA256 is available in SI records at time of analysis. Detection: Win64.Backdoor.SupplyChain.

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether soopsocks v0.2.7 appears in your dependency tree. Any pipeline that ran pip install while this version was current should be considered potentially affected.
Update immediately: No clean version of soopsocks exists -- remove the package entirely.
Inspect affected systems: Check for the SoopSocksSvc Windows service, scheduled task SoopSocksAuto, firewall rules named "SoopSocks TCP 1080" and "SoopSocks UDP 1080", and any process listening on TCP/UDP port 1080.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
config.py	af7a02faa5680c7ac730be0e84e7ca83da28761fbd7b222145b5e900afd7159c	Script-Python.Backdoor.SupplyChain
PKG-INFO	35f7d7c76b2b6d95bc7f52a20623407473816134d8b62abc7e44860790dc8fb1	Text.Backdoor.SupplyChain
pyproject.toml	6c6e83f013b083cebd7381393e3387dbd1ac6fdb005ad87a4074c3e4192d3f40	Text.Backdoor.SupplyChain

Network IOCs

URL / IP	Purpose
https://discord.com/api/webhooks/1418298773330985154/_I7EzXpGMundYt8jCvlDdzi9INsBkBq7NSDM74iV0Y_flSzQZ5LxYP0lZtXFzHCkRtKR	Attacker-controlled Discord webhook; receives victim public and local IP reports every 30 seconds
https://api.ipify.org	Public IP lookup service used to probe victim's egress IP
https://ifconfig.me/ip	Public IP lookup service used to probe victim's egress IP
https://checkip.amazonaws.com	Public IP lookup service used to probe victim's egress IP
https://ipinfo.io/ip	Public IP lookup service used to probe victim's egress IP

Archive Hashes

File	SHA256
soopsocks-0.2.7-py3-none-any.whl	f25193d1900504797dd0ec3dfa7cfa5018666f8281b56b5df56949786135e6ee
soopsocks-0.2.7.tar.gz	28567f423088bc9abe994878f25de0835076441cfe76c028a055845d19cafa5e

soopsocks

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: about 1 year agoVersion: 0.2.7

INCIDENTS FOR THIS VERSION:

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes

Did you know...

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes