{"id":"MAL-2026-16098","kind":"package","aliases":["MAL-2026-16098"],"related":[],"title":"Malicious code in bq-build-probe-vrp-2026 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65)\nsetup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the GCE metadata service-account email (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email), plus sandbox-fingerprinting signals (docker socket presence at /var/run/docker.sock, outbound reachability via socket connect to 8.8.8.8:53). The collected data is written to _build_findings.json inside the installed package, and __init__.py exposes get_build_findings() to read it back. In a CI/build environment, os.environ typically contains build secrets (CI tokens, cloud credentials, service-account material); embedding that dump inside the built artifact and providing a retrieval API turns any subsequent import or redistribution of the wheel into a channel for the harvested secrets. The package's self-description as authorized VRP testing does not change the mechanism.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bq-build-probe-vrp-2026","fixed":[],"affected":"= 0.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-09T19:01:41+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16098':13A,16A '-2026':12A,15A '/computemetadata/v1/instance/service-accounts/default/email),':67C '/proc/self/cgroup':55C '/proc/version':56C '/var/run/docker.sock':77C '2026':9A,22A '46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65':38C '53':85C '8.8.8.8':84C 'account':63C,123C 'amazon':36C 'amazon-inspector':35C 'api':136C 'artifact':131C 'author':160C 'back':107C 'bq':5A,18A 'bq-build-probe-vrp':4A,17A 'build':6A,19A,102C,115C 'build_findings.json':92C 'built':130C 'chang':165C 'channel':148C 'ci':117C 'ci/build':110C 'cloud':119C 'code':2A 'collect':45C,87C 'connect':82C 'contain':114C 'credenti':120C 'data':88C 'descript':158C 'detail':27C 'docker':73C 'dump':48C,127C 'edit':30C 'email':64C 'embed':125C 'environ':111C 'execut':40C 'expos':100C 'find':103C 'fingerprint':71C 'full':47C 'gce':59C 'get':101C 'harvest':151C 'hostnam':51C 'import':140C 'init':98C 'insid':93C,128C 'inspector':37C 'instal':43C,95C 'line':33C 'mal':11A,14A 'malici':1A,23B 'materi':124C 'mechan':167C 'metadata':60C 'metadata.google.internal':66C 'metadata.google.internal/computemetadata/v1/instance/service-accounts/default/email),':65C 'os.environ':50C,112C 'outbound':78C 'output':54C 'packag':24B,96C,154C 'per':25C 'pip':42C 'plus':68C 'presenc':75C 'probe':7A,20A 'provid':133C 'py':99C 'pypi':10A 'reachabl':79C 'read':105C 'redistribut':142C 'retriev':135C 'sandbox':70C 'sandbox-fingerprint':69C 'secret':116C,152C 'self':157C 'self-descript':156C 'servic':62C,122C 'service-account':61C,121C 'setup.py':39C 'signal':72C 'socket':74C,81C 'sourc':26C,34C 'subsequ':139C 'test':162C 'token':118C 'turn':137C 'typic':113C 'uid/gid':52C 'unam':53C 'via':80C 'vrp':8A,21A,161C 'wheel':145C 'written':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-09T19:01:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16098","url":"https://osv.dev/vulnerability/MAL-2026-16098","severity":"critical","published_at":"2026-09-09T19:01:41+00:00","modified_at":"2026-09-09T19:30:05+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}