# MAL-2026-4753: Malicious code in gt-tester-exp-profiler-exp-00000017 (PyPI)


- **Type:** Malicious package
- **Package:** `gt-tester-exp-profiler-exp-00000017` (PyPI)
- **Published:** 22 May 2026

## What is MAL-2026-4753?

MAL-2026-4753 is a malicious package in gt-tester-exp-profiler-exp-00000017, published on 22 May 2026. 

### Official description

setup.py installs a site-wide.pth file (gt_tester_exp_profiler_exp_00000017_probe.pth) into site-packages that imports the package's probe module and calls run_probe() at every Python interpreter startup. probe.py performs a plaintext HTTP GET to the bare IP 104.236.116.157 with a per-call random hex tag, fingerprinting the installer's machine to a third party on every Python invocation — not just when the package is explicitly imported. The User-Agent string claims an 'Academic research study' but no consent is obtained at install or runtime. Package metadata is a generic placeholder with no author, homepage, or publisher identification, and the destination is a bare IP not associated with any declared publisher. The.pth mechanism converts what would be an import-time call into persistent host beaconing across every CI job, virtualenv activation, and script execution on the machine.

## What should I do about MAL-2026-4753?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4753 is a malicious package: gt-tester-exp-profiler-exp-00000017 (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4753/ (Markdown: https://insights.sbomify.com/MAL-2026-4753/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4753

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4753/
Summaries are generated and may contain mistakes; the official description above is the record.