MAL-2026-18760

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/expect-tests/MAL-2026-18760.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18760
Published
2026-11-08T09:39:19Z
Modified
2026-11-08T10:15:03Z
Summary
Malicious code in expect-tests (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76)

setup.py and gcp_log_poc/init.py read the installer's hostname via platform.node() and encode it into a subdomain of testa213022.dssldrf.net, then invoke socket.getaddrinfo() to trigger DNS resolution to that domain's authoritative server. This causes the installer's hostname to be exfiltrated to a non-first-party DNS server both when pip builds/installs the package (setup.py) and whenever the installed module is imported. The destination domain is unrelated to any legitimate purpose declared by the package, the package name (expect-tests) and the imported module name (gcp_log_poc) do not match, and the behavior is undisclosed. The 99.99.99 version number and name-vs-module mismatch are consistent with a dependency-confusion / name-squat lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022564",
            "import_time": "2026-11-08T10:11:08.834920047Z",
            "modified_time": "2026-11-08T09:39:19Z",
            "sha256": "f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / expect-tests

Package

Name
expect-tests
View open source insights on deps.dev
Purl
pkg:pypi/expect-tests

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "artifacts": [
                "expect_tests-99.99.99.tar.gz"
            ],
            "path": "setup.py",
            "sha256": "a597a3e5592644378f74b97da44915086e9e95cb52b22cd935d816cdfe62e0fe",
            "tlsh": "76e0f102d6379d82246015c508f520615f7a45277f31148d778903116fde05a8427603"
        },
        {
            "artifacts": [
                "expect_tests-99.99.99.tar.gz",
                "expect_tests-99.99.99-py3-none-any.whl"
            ],
            "path": "gcp_log_poc/__init__.py",
            "sha256": "4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e",
            "tlsh": "0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"
        }
    ],
    "package_integrity": [
        {
            "filename": "expect_tests-99.99.99-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "f33655dc51fc8de8d0ecd23dddb4d77ae09012ef70ba949e49309bc40cc885c7",
                "md5": "b6eea7e94793b86701213fee206f15d9",
                "sha256": "2b9dcb463e0ba199ea9190d886108fd6755d8d0b7fc98ce3b707a90083bd0c6d"
            }
        },
        {
            "filename": "expect_tests-99.99.99.tar.gz",
            "hashes": {
                "blake2b_256": "74317957a2a18ab3cf33e51c850174c77c9889d06475df6ee1aac434989bcd25",
                "md5": "3758dda374c934c3dd3027d1f10e7dc2",
                "sha256": "9ad45e2a800b4d7a57b6005204560d85aa911541d5cf2e2fd8ad1386830e1930"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/expect-tests/MAL-2026-18760.json"