{"answers":{"affected":"1 open source package ship an affected version, including gt-tester-exp-profiler-exp-00000015.","exploited":"There is no known exploitation of MAL-2026-4752 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4752 is a malicious package in gt-tester-exp-profiler-exp-00000015, published on 22 May 2026."},"fix_prompt":"MAL-2026-4752 is a malicious package: gt-tester-exp-profiler-exp-00000015 (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4752/ (Markdown: https://insights.sbomify.com/MAL-2026-4752/index.md)","id":"MAL-2026-4752","markdown":"https://insights.sbomify.com/MAL-2026-4752/index.md","name":"MAL-2026-4752","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"setup.py installs a.pth file containing `import gt_tester_exp_profiler_exp_00000015.probe; probe.run_probe()`, causing every Python interpreter start on the installer's machine to execute the package's probe module. The probe issues a plaintext HTTP GET to http://104.131.173.16/exp-\u003ctag\u003e-\u003chash16\u003e, leaking the installer's source IP, interpreter-launch cadence, and a per-call hash to a hardcoded third-party host with no opt-in. Because.pth files auto-execute on every `python` invocation (not only when the package is imported), this constitutes installer-side persistence: the beacon fires for unrelated Python processes long after the user has forgotten the package is installed. The destination is a bare IPv4 address over cleartext HTTP with no integrity verification, so any future operator of that IP — or any on-path attacker — can serve arbitrary responses to the beacon. The User-Agent only references an opt-OUT URL, confirming the author knew consent was absent.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI)","id":"MAL-2026-4752","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"gt-tester-exp-profiler-exp-00000015","purl":"pkg:pypi/gt-tester-exp-profiler-exp-00000015","source":"MAL-2026-4752"}],"products":null,"published":"2026-05-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4752/"}