Alert: Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown

The Hacker News reports a malicious PyPI package named soopsocks that offered a SOCKS5 proxy service while delivering backdoor-like functionality to drop additional payloads on Windows systems, and it had attracted 2,653 downloads before being taken down. It was first uploaded by a user named soodalpie on 26 September 2025, the same date the account was created, and the developer claims the package provides a bootstrapped proxy with Windows support.

According to JFrog, the executable _AUTORUN.EXE uses a Go binary that not only implements SOCKS5 but also runs PowerShell scripts, sets firewall rules, and relaunches with elevated permissions, while performing reconnaissance such as checking Internet Explorer security settings and Windows installation date and exfiltrating this data to a hard-coded Discord webhook.

Versions 0.2.5 and 0.2.6 of the package also deploy _AUTORUN.VBS to run PowerShell, download a ZIP containing the legitimate Python binary, and generate a batch script to install and run the package via pip. The threat actors configure UDP and TCP traffic on port 1080, install as a service, establish persistence via a scheduled task, and maintain command-and-control communication with a Discord webhook.

According to the report, the package’s design and runtime actions indicate malicious activity, despite its advertised proxy functionality, reinforcing concerns around software supply chain security and token management across ecosystems.