expect-tests

{"schema_version":"1.7.4","id":"MAL-2026-18760","published":"2026-11-08T09:39:19Z","modified":"2026-11-08T14:12:22.343721718Z","summary":"Malicious code in expect-tests (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76)\nsetup.py and gcp_log_poc/__init__.py read the installer's hostname via platform.node() and encode it into a subdomain of testa213022.dssldrf.net, then invoke socket.getaddrinfo() to trigger DNS resolution to that domain's authoritative server. This causes the installer's hostname to be exfiltrated to a non-first-party DNS server both when pip builds/installs the package (setup.py) and whenever the installed module is imported. The destination domain is unrelated to any legitimate purpose declared by the package, the package name (`expect-tests`) and the imported module name (`gcp_log_poc`) do not match, and the behavior is undisclosed. The 99.99.99 version number and name-vs-module mismatch are consistent with a dependency-confusion / name-squat lure.\n\n## Source: kam193 (a39f8a715e51027cca924163b2f9da3864a4f21a1707f9936e658058ddde5f4a)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"expect-tests","ecosystem":"PyPI"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["expect_tests-99.99.99.tar.gz"],"path":"setup.py","sha256":"a597a3e5592644378f74b97da44915086e9e95cb52b22cd935d816cdfe62e0fe","tlsh":"76e0f102d6379d82246015c508f520615f7a45277f31148d778903116fde05a8427603"},{"artifacts":["expect_tests-99.99.99.tar.gz","expect_tests-99.99.99-py3-none-any.whl"],"path":"gcp_log_poc/__init__.py","sha256":"4f4433d1b9b0dfe50d840daa089f6e931b6e984b1f9dc41fc41fa80a8299137e","tlsh":"0cd02b07e3b59c43a66222c700e871719e7f81026f2a1c6e69991b91cfaa4649535b54"}],"package_integrity":[{"filename":"expect_tests-99.99.99-py3-none-any.whl","hashes":{"blake2b_256":"f33655dc51fc8de8d0ecd23dddb4d77ae09012ef70ba949e49309bc40cc885c7","md5":"b6eea7e94793b86701213fee206f15d9","sha256":"2b9dcb463e0ba199ea9190d886108fd6755d8d0b7fc98ce3b707a90083bd0c6d"}},{"filename":"expect_tests-99.99.99.tar.gz","hashes":{"blake2b_256":"74317957a2a18ab3cf33e51c850174c77c9889d06475df6ee1aac434989bcd25","md5":"3758dda374c934c3dd3027d1f10e7dc2","sha256":"9ad45e2a800b4d7a57b6005204560d85aa911541d5cf2e2fd8ad1386830e1930"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/expect-tests/99.99.99/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/expect-tests"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022564","import_time":"2026-11-08T10:11:08.834920047Z","modified_time":"2026-11-08T09:39:19Z","sha256":"f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76","source":"amazon-inspector","versions":["99.99.99"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/expect-tests","import_time":"2026-11-08T14:10:37.56635549Z","modified_time":"2026-11-08T13:50:39.673698Z","sha256":"a39f8a715e51027cca924163b2f9da3864a4f21a1707f9936e658058ddde5f4a","source":"kam193","versions":["99.99.99"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}