---
id: "MAL-2026-16098"
kind: "package"
aliases: ["MAL-2026-16098"]
title: "Malicious code in bq-build-probe-vrp-2026 (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bq-build-probe-vrp-2026", "fixed": [], "affected": "= 0.2.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-09T19:01:41+00:00"
first_seen_at: "2026-10-26T20:51:57+00:00"
updated_at: "2026-10-26T21:10:31+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-16098", "first_seen_at": "2026-10-26T20:51:57+00:00"}]
---

# Malicious code in bq-build-probe-vrp-2026 (PyPI)

## Affected

- pypi:bq-build-probe-vrp-2026 affected = 0.2.0 fixed ?

## Timeline

- 2026-10-26T20:51:57+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-16098

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65)
setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the GCE metadata service-account email (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email), plus sandbox-fingerprinting signals (docker socket presence at /var/run/docker.sock, outbound reachability via socket connect to 8.8.8.8:53). The collected data is written to _build_findings.json inside the installed package, and __init__.py exposes get_build_findings() to read it back. In a CI/build environment, os.environ typically contains build secrets (CI tokens, cloud credentials, service-account material); embedding that dump inside the built artifact and providing a retrieval API turns any subsequent import or redistribution of the wheel into a channel for the harvested secrets. The package's self-description as authorized VRP testing does not change the mechanism.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_