MAL-2026-4752

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gt-tester-exp-profiler-exp-00000015/MAL-2026-4752.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4752
Published
2026-05-22T08:27:01Z
Modified
2026-05-26T06:03:10.453715001Z
Summary
Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75)

setup.py installs a.pth file containing import gt_tester_exp_profiler_exp_00000015.probe; probe.run_probe(), causing every Python interpreter start on the installer's machine to execute the package's probe module. The probe issues a plaintext HTTP GET to http://104.131.173.16/exp-<tag>-<hash16>, leaking the installer's source IP, interpreter-launch cadence, and a per-call hash to a hardcoded third-party host with no opt-in. Because.pth files auto-execute on every python invocation (not only when the package is imported), this constitutes installer-side persistence: the beacon fires for unrelated Python processes long after the user has forgotten the package is installed. The destination is a bare IPv4 address over cleartext HTTP with no integrity verification, so any future operator of that IP — or any on-path attacker — can serve arbitrary responses to the beacon. The User-Agent only references an opt-OUT URL, confirming the author knew consent was absent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:52:04.362282283Z",
            "sha256": "55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75",
            "modified_time": "2026-05-22T08:27:01Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-004170",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / gt-tester-exp-profiler-exp-00000015

Package

Name
gt-tester-exp-profiler-exp-00000015
View open source insights on deps.dev
Purl
pkg:pypi/gt-tester-exp-profiler-exp-00000015

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gt-tester-exp-profiler-exp-00000015/MAL-2026-4752.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "22e13e32e425b335bf728d37ba8bae5d186198576a76f74d00f805ea3454a527",
            "tlsh": "5101d087d8132023d347c8aeaa81e9116b6b7d9ba9ca54b0b9ce0a391fc1924c071553",
            "path": "gt_tester_exp_profiler_exp_00000015/probe.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "gt_tester_exp_profiler_exp_00000015-1.0.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "eebc662aa1d34b7b3a5fe042dc5f8c16dd24f07d9bafdbd0fba41afbef6892e5",
                "sha256": "36b2574e5b6334a112ff089fa3a702db7228d8d9f03c3755ccd1de4f3a9187f4",
                "md5": "f97b08fadb4b3222806678d075a0a7ff"
            }
        },
        {
            "filename": "gt_tester_exp_profiler_exp_00000015-1.0.0.tar.gz",
            "hashes": {
                "blake2b_256": "ff89520d353f0a9dce4d33b17b2a3bfabfaa492318fc0b75fbfdeed5ff550732",
                "sha256": "713664e11333a9c60d0a039fa7aa1a89563e242827077874f00274e2d0800f61",
                "md5": "c72c39e1af1c35432a88d7910c157850"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]