hello-world-test-mh3

{"schema_version":"1.7.4","id":"MAL-2026-10908","published":"2026-07-20T10:13:14Z","modified":"2026-08-05T06:02:58.637504091Z","summary":"Malicious code in hello-world-test-mh3 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd)\nPackage is a trivial hello-world test artifact. setup.py contains an exec(base64.b64decode(...)) call at install time, but the decoded payload is a single print() statement with no network, filesystem, or credential side effects. src/hello_world/__init__.py defines a _remote_update() function whose urlopen+exec branch is guarded by a constant _SIMULATE_ONLY=True, making the network-fetch-and-exec branch statically unreachable; the reachable branch only execs a local print string. No outbound network occurs, no installer secrets are read, and no attacker-controlled code or destination is referenced. The exec+base64 and import-time fetch-and-exec shapes are present as structural patterns only, with no installer-side harm.\n","affected":[{"package":{"name":"hello-world-test-mh3","ecosystem":"PyPI","purl":"pkg:pypi/hello-world-test-mh3"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"b7ee596d9e0b34913ed897234dbeefaedfc41fa445d3ee9d8374f2fcf1ff1f24","tlsh":"df31738bee216e7542c5db758d9372e59f3b602f3bd0446ca9ce83488b0a120416b689"},{"path":"src/hello_world/__init__.py","sha256":"270975ef15fc05e8e82ff2c02a9daa5f7ab2446ac4700cfe5b10c244cb6fd793","tlsh":"0d31866396412e379869c926ac523198933f315b63544538fe0e839c3f66694c6f43cd"}],"package_integrity":[{"filename":"hello_world_test_mh3-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"2d6f3e1734b3634e0109557631350bd1c9c9b4d8aafacc7ce4686016e1e684b7","md5":"c2566ec49184b144a9d8a5a35d345b3d","sha256":"09acadb6567f7b24ec092c0f27923f78456b95fc8c1d2a173f8ce2e75b57be8d"}},{"filename":"hello_world_test_mh3-0.0.1.tar.gz","hashes":{"blake2b_256":"4f8666dd5cfc1a275fcbf98f846d6b0d4c504496e09df4d6341411a6a0d99248","md5":"dc935152ce241995c4e8091f92d4b2f0","sha256":"587f97e880cf6c04d946967e5e30a42a96404cd8aa22fc6c14010d9e82330180"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/hello-world-test-mh3/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-05387","import_time":"2026-07-20T13:14:38.734399663Z","modified_time":"2026-07-20T10:13:14Z","sha256":"08712dd08827b6758605078d00141531143487093dfd34c30b01c0555c5ee399","source":"reversing-labs","versions":["0.0.1"]},{"id":"IN-MAL-2026-013148","import_time":"2026-08-05T06:00:47.469137198Z","modified_time":"2026-08-05T05:40:44Z","sha256":"876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}