hello-world-test-mh2

{"schema_version":"1.7.4","id":"MAL-2026-10907","published":"2026-07-20T10:13:14Z","modified":"2026-08-05T06:02:58.635933751Z","summary":"Malicious code in hello-world-test-mh2 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13)\nsetup.py decodes a base64 string and passes the result to exec() at install time. The decoded payload is a single print() statement that emits a benign string. A sibling _exfiltrate() function imports socket and urllib.request but the imported modules are never invoked; the function only prints the local platform name. There is no outbound network I/O, no reads of installer secrets or environment variables, no filesystem persistence beyond what pip itself performs, and no follow-on code execution. The package presents itself as a scanner-test artifact and behaves accordingly. The use of exec() on a base64 blob is poor practice (it matches the shape of install-time droppers and will trip pattern-based scanners), but the decoded content here is inert and confers no benefit to the publisher.\n","affected":[{"package":{"name":"hello-world-test-mh2","ecosystem":"PyPI","purl":"pkg:pypi/hello-world-test-mh2"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"b7ee596d9e0b34913ed897234dbeefaedfc41fa445d3ee9d8374f2fcf1ff1f24","tlsh":"df31738bee216e7542c5db758d9372e59f3b602f3bd0446ca9ce83488b0a120416b689"}],"package_integrity":[{"filename":"hello_world_test_mh2-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"44f6780f3e155b842db464f51313a9e9c65f764cf473d01e80da28bb4abbfb45","md5":"f0054eb64fa4652fe4972f90da164301","sha256":"4783fefd1bab54c4444b8ab737c54287f9e597566914bcdaa143b3cd247d9b61"}},{"filename":"hello_world_test_mh2-0.0.1.tar.gz","hashes":{"blake2b_256":"6569af2e20945454a794c19b634e2493971db835d999b3c45afefb184d010dbd","md5":"5400330616a3ed55bae8bd26e1c73054","sha256":"adc5e96300cf3d128b10a90d62bb2bddf6b04002ab0f2342be5b513d034510f1"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/hello-world-test-mh2/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-05386","import_time":"2026-07-20T13:14:38.64031409Z","modified_time":"2026-07-20T10:13:14Z","sha256":"621728ade22e0fd93c65e3c7ca29934f2d1cdb8cdd603fea36da803fa3688c47","source":"reversing-labs","versions":["0.0.1"]},{"id":"IN-MAL-2026-013140","import_time":"2026-08-05T06:00:46.486438723Z","modified_time":"2026-08-05T05:39:37Z","sha256":"68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}