{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "gt_tester_exp_profiler_exp_00000015/probe.py",
              "sha256": "22e13e32e425b335bf728d37ba8bae5d186198576a76f74d00f805ea3454a527",
              "tlsh": "5101d087d8132023d347c8aeaa81e9116b6b7d9ba9ca54b0b9ce0a391fc1924c071553"
            }
          ],
          "package_integrity": [
            {
              "filename": "gt_tester_exp_profiler_exp_00000015-1.0.0-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "eebc662aa1d34b7b3a5fe042dc5f8c16dd24f07d9bafdbd0fba41afbef6892e5",
                "md5": "f97b08fadb4b3222806678d075a0a7ff",
                "sha256": "36b2574e5b6334a112ff089fa3a702db7228d8d9f03c3755ccd1de4f3a9187f4"
              }
            },
            {
              "filename": "gt_tester_exp_profiler_exp_00000015-1.0.0.tar.gz",
              "hashes": {
                "blake2b_256": "ff89520d353f0a9dce4d33b17b2a3bfabfaa492318fc0b75fbfdeed5ff550732",
                "md5": "c72c39e1af1c35432a88d7910c157850",
                "sha256": "713664e11333a9c60d0a039fa7aa1a89563e242827077874f00274e2d0800f61"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "gt-tester-exp-profiler-exp-00000015"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004170",
        "import_time": "2026-05-26T05:52:04.362282283Z",
        "modified_time": "2026-05-22T08:27:01Z",
        "sha256": "55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75)\nsetup.py installs a.pth file containing `import gt_tester_exp_profiler_exp_00000015.probe; probe.run_probe()`, causing every Python interpreter start on the installer\u0027s machine to execute the package\u0027s probe module. The probe issues a plaintext HTTP GET to http://104.131.173.16/exp-\u003ctag\u003e-\u003chash16\u003e, leaking the installer\u0027s source IP, interpreter-launch cadence, and a per-call hash to a hardcoded third-party host with no opt-in. Because.pth files auto-execute on every `python` invocation (not only when the package is imported), this constitutes installer-side persistence: the beacon fires for unrelated Python processes long after the user has forgotten the package is installed. The destination is a bare IPv4 address over cleartext HTTP with no integrity verification, so any future operator of that IP \u2014 or any on-path attacker \u2014 can serve arbitrary responses to the beacon. The User-Agent only references an opt-OUT URL, confirming the author knew consent was absent.\n",
  "id": "MAL-2026-4752",
  "modified": "2026-05-22T08:27:01Z",
  "published": "2026-05-22T08:27:01Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/gt-tester-exp-profiler-exp-00000015/1.0.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI)"
}