bq-build-probe-vrp-2026

{"modified":"2026-09-09T19:01:41Z","published":"2026-09-09T19:01:41Z","schema_version":"1.7.4","id":"MAL-2026-16098","summary":"Malicious code in bq-build-probe-vrp-2026 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65)\nsetup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the GCE metadata service-account email (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email), plus sandbox-fingerprinting signals (docker socket presence at /var/run/docker.sock, outbound reachability via socket connect to 8.8.8.8:53). The collected data is written to _build_findings.json inside the installed package, and __init__.py exposes get_build_findings() to read it back. In a CI/build environment, os.environ typically contains build secrets (CI tokens, cloud credentials, service-account material); embedding that dump inside the built artifact and providing a retrieval API turns any subsequent import or redistribution of the wheel into a channel for the harvested secrets. The package's self-description as authorized VRP testing does not change the mechanism.\n","affected":[{"package":{"ecosystem":"PyPI","name":"bq-build-probe-vrp-2026"},"versions":["0.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"1abb795299fd30e5e25b86aa6254709e9b5adb80fc8fcd64c6f6a41a84f28e65","tlsh":"ad6133b1d8254222d2d340ae186dd650e6736f732bd278ac79dda5202f56438b1713de"}],"package_integrity":[{"filename":"bq_build_probe_vrp_2026-0.2.0.tar.gz","hashes":{"blake2b_256":"957493bf639cc93922358f645f23311caa7447b1233827305b1872bc84ff3de8","md5":"b82d0f4917f990968a694fad5b4b9f47","sha256":"9e77b430df2682b4284c0be7ee3b3b22927c52feac1c908cdc1363f9b8acec9f"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/bq-build-probe-vrp-2026/0.2.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019893","import_time":"2026-09-09T19:14:57.827195476Z","modified_time":"2026-09-09T19:01:41Z","sha256":"46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65","source":"amazon-inspector","versions":["0.2.0"]}]}}