MAL-2026-4753 Malicious code in gt-tester-exp-profiler-exp-00000017 (PyPI)
Malicious package
Published
MAL-2026-4753 is a malicious package: gt-tester-exp-profiler-exp-00000017 (PyPI). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4753/ (Markdown: https://insights.sbomify.com/MAL-2026-4753/index.md)
- Package
- gt-tester-exp-profiler-exp-00000017
- Registry
- PyPI
What is MAL-2026-4753?
MAL-2026-4753 is a malicious package in gt-tester-exp-profiler-exp-00000017, published on 22 May 2026.
Official description
setup.py installs a site-wide.pth file (gt_tester_exp_profiler_exp_00000017_probe.pth) into site-packages that imports the package's probe module and calls run_probe() at every Python interpreter startup. probe.py performs a plaintext HTTP GET to the bare IP 104.236.116.157 with a per-call random hex tag, fingerprinting the installer's machine to a third party on every Python invocation — not just when the package is explicitly imported. The User-Agent string claims an 'Academic research study' but no consent is obtained at install or runtime. Package metadata is a generic placeholder with no author, homepage, or publisher identification, and the destination is a bare IP not associated with any declared publisher. The.pth mechanism converts what would be an import-time call into persistent host beaconing across every CI job, virtualenv activation, and script execution on the machine.
What should I do about MAL-2026-4753?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.