gt-tester-exp-profiler-exp-00000015

{"modified":"2026-05-22T08:27:01Z","published":"2026-05-22T08:27:01Z","schema_version":"1.7.4","id":"MAL-2026-4752","summary":"Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75)\nsetup.py installs a.pth file containing `import gt_tester_exp_profiler_exp_00000015.probe; probe.run_probe()`, causing every Python interpreter start on the installer's machine to execute the package's probe module. The probe issues a plaintext HTTP GET to http://104.131.173.16/exp-<tag>-<hash16>, leaking the installer's source IP, interpreter-launch cadence, and a per-call hash to a hardcoded third-party host with no opt-in. Because.pth files auto-execute on every `python` invocation (not only when the package is imported), this constitutes installer-side persistence: the beacon fires for unrelated Python processes long after the user has forgotten the package is installed. The destination is a bare IPv4 address over cleartext HTTP with no integrity verification, so any future operator of that IP — or any on-path attacker — can serve arbitrary responses to the beacon. The User-Agent only references an opt-OUT URL, confirming the author knew consent was absent.\n","affected":[{"package":{"ecosystem":"PyPI","name":"gt-tester-exp-profiler-exp-00000015"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"gt_tester_exp_profiler_exp_00000015/probe.py","sha256":"22e13e32e425b335bf728d37ba8bae5d186198576a76f74d00f805ea3454a527","tlsh":"5101d087d8132023d347c8aeaa81e9116b6b7d9ba9ca54b0b9ce0a391fc1924c071553"}],"package_integrity":[{"filename":"gt_tester_exp_profiler_exp_00000015-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"eebc662aa1d34b7b3a5fe042dc5f8c16dd24f07d9bafdbd0fba41afbef6892e5","md5":"f97b08fadb4b3222806678d075a0a7ff","sha256":"36b2574e5b6334a112ff089fa3a702db7228d8d9f03c3755ccd1de4f3a9187f4"}},{"filename":"gt_tester_exp_profiler_exp_00000015-1.0.0.tar.gz","hashes":{"blake2b_256":"ff89520d353f0a9dce4d33b17b2a3bfabfaa492318fc0b75fbfdeed5ff550732","md5":"c72c39e1af1c35432a88d7910c157850","sha256":"713664e11333a9c60d0a039fa7aa1a89563e242827077874f00274e2d0800f61"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/gt-tester-exp-profiler-exp-00000015/1.0.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004170","import_time":"2026-05-26T05:52:04.362282283Z","modified_time":"2026-05-22T08:27:01Z","sha256":"55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75","source":"amazon-inspector","versions":["1.0.0"]}]}}