MAL-2026-18097 Malicious code in research-probe-6150c1c915 (PyPI)

The package ships a .pth file that imports research_probe_6150c1c915._boot on every Python interpreter startup, with no explicit import by the user required. _boot.py executes bootstrap() which snapshots the full os.environ, enumerates /proc/*/cmdline for up to 200 processes, and queries the GCP instance metadata service at http://169.254.169.254/computeMetadata/v1/?recursive=true and .../service-accounts/default/email with the Metadata-Flavor: Google header. The recursive=true metadata query on a GCE/GKE/Cloud Run host returns service-account OAuth access tokens and other credential material. Collected data (environment variables and metadata responses, including any returned tokens) is written as JSON to /tmp/research_probe_6150c1c915/ and to a _runs/ directory inside the installed package. The /tmp destination is world-readable on default Linux configurations, so any local account on the same host can read the harvested cloud credentials and environment. The .pth auto-execution mechanism makes this fire on every Python invocation after install, not just when the module is imported.

The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a local filesystem, suggesting the operator has to have some degree of control of the environment.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-omeraf

Reasons (based on the campaign):

• exfiltration-cloud-tokens

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• other

• abuses-pth