MAL-2026-10907

Dashboard / Malicious Package / MAL-2026-10907

MAL-2026-10907

Summary: Malicious code in hello-world-test-mh2 (PyPI)

Details: Source: amazon-inspector (68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13) setup.py decodes a base64 string and passes the result to exec() at install time. The decoded payload is a single print() statement that emits a benign string. A sibling _exfiltrate() function imports socket and urllib.request but the imported modules are never invoked; the function only prints the local platform name. There is no outbound network I/O, no reads of installer secrets or environment variables, no filesystem persistence beyond what pip itself performs, and no follow-on code execution. The package presents itself as a scanner-test artifact and behaves accordingly. The use of exec() on a base64 blob is poor practice (it matches the shape of install-time droppers and will trip pattern-based scanners), but the decoded content here is inert and confers no benefit to the publisher.

References: https://pypi.org/project/hello-world-test-mh2/0.0.1/