MAL-2026-10908

Dashboard / Malicious Package / MAL-2026-10908

MAL-2026-10908

Summary: Malicious code in hello-world-test-mh3 (PyPI)

Details: Source: amazon-inspector (876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd) Package is a trivial hello-world test artifact. setup.py contains an exec(base64.b64decode(...)) call at install time, but the decoded payload is a single print() statement with no network, filesystem, or credential side effects. src/hello_world/__init__.py defines a _remote_update() function whose urlopen+exec branch is guarded by a constant _SIMULATE_ONLY=True, making the network-fetch-and-exec branch statically unreachable; the reachable branch only execs a local print string. No outbound network occurs, no installer secrets are read, and no attacker-controlled code or destination is referenced. The exec+base64 and import-time fetch-and-exec shapes are present as structural patterns only, with no installer-side harm.

References: https://pypi.org/project/hello-world-test-mh3/0.0.1/