glass-of-water

{"modified":"2026-05-26T05:55:05Z","published":"2026-05-19T21:07:17Z","schema_version":"1.7.4","id":"MAL-2026-4751","summary":"Malicious code in glass-of-water (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (df79336313f71fac8158ff6f3e0160d0e99a8d1d84c452505fd3739af5838a69)\nglass_of_water/__init__.py embeds 10 Google Gemini API keys (AIzaSy...) split across 5-part dictionaries and reassembled at runtime by _get_api_key() (L6-19). The split-and-reassemble pattern is a deliberate evasion of registry/secret scanners. The exported water(prompt,...) function unconditionally instantiates `genai.Client(api_key=api_key)` and calls `client.models.generate_content(model='gemini-flash-latest', contents=system_instruction + prompt)` (L36-41) — there is no env-var override or opt-in path for caller-supplied credentials. Two installer-relevant harms result: (1) live third-party credentials are redistributed to every installer, who can extract and abuse them against Google's Gemini API; (2) any caller of water() silently routes their prompt content to a Google project owned by the author, where it is billed and logged under the author's account. Author metadata is placeholder (`Your Name <your.email@example.com>`) and the description is generic, consistent with a low-effort publish rather than a maintained utility.\n","affected":[{"package":{"ecosystem":"PyPI","name":"glass-of-water"},"versions":["1.0.1","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"glass_of_water/__init__.py","sha256":"5a442c93fcb162e8f39d9a35d7615221d3a3813a28575ee4f676c4d5bbfc2fb3","tlsh":"3b41339ba856974746075c3fb60b893040ed5da34bc8643371cd829cefcf1b58a79ba8"}],"package_integrity":[{"filename":"glass_of_water-1.0.1-py3-none-any.whl","hashes":{"blake2b_256":"dc451bd7af90ade3defdaa2020f2b31b006835965618570c5eb017631937a77c","md5":"9b4b17c84c870cfc24a8c81f1b89f7a2","sha256":"4b4728e5b92b4155c2f08777dfe30d4f0970ac172d4c6500287fdbd95c40ecf7"}},{"filename":"glass_of_water-1.0.1.tar.gz","hashes":{"blake2b_256":"b077be99b1cbac727cf34fe73f02082891cca9af72779d975d236eb004fbeecf","md5":"a6797161241475dcd0b1da774402f9d0","sha256":"715d57cb94ae50c59b52e5c5df9c0320816f1f80dd64badfc1fb44900dc129d9"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/glass-of-water/1.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/glass-of-water/1.0.3/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003283","import_time":"2026-05-26T05:50:20.904003828Z","modified_time":"2026-05-19T21:27:12Z","sha256":"1af67dc68557257c7479e62a238fffaee75fc8620ce6b91e4b37f7bb04837111","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-003282","import_time":"2026-05-26T05:50:20.804031834Z","modified_time":"2026-05-19T21:07:17Z","sha256":"df79336313f71fac8158ff6f3e0160d0e99a8d1d84c452505fd3739af5838a69","source":"amazon-inspector","versions":["1.0.3"]}]}}