MAL-2026-18760: Malicious code in expect-tests (PyPI)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76) setup.py and gcplogpoc/init.py read the installer's hostname via platform.node() and encode it into a subdomain of testa213022.dssldrf.net, then invoke socket.getaddrinfo() to trigger DNS resolution to that domain's authoritative server. This causes the installer's hostname to be exfiltrated to a non-first-party DNS server both when pip builds/installs the package (setup.py) and whenever the installed module is imported. The destination domain is unrelated to any legitimate purpose declared by the package, the package name (expect-tests) and the imported module name (gcplogpoc) do not match, and the behavior is undisclosed. The 99.99.99 version number and name-vs-module mismatch are consistent with a dependency-confusion / name-squat lure.

Affected Software

1 affected component

pip/expect-tests=99.99.99

Event History

Nov 8, 2026

Advisory Published

via OSV·09:39 AM

Data Sourced

via OSV·09:39 AM

DescriptionAffected Software

Frequently Asked Questions

When can the hostname exfiltration occur?

It can occur during pip build or installation through setup.py, and again whenever the installed gcp_log_poc module is imported. In both cases, the installer or host hostname is encoded into a DNS subdomain and resolved.

What information is sent and where does it go?

The package reads the hostname using platform.node() and encodes it into a subdomain of testa213022.dssldrf.net. DNS resolution sends that hostname-derived query to the domain's authoritative DNS server, which is not a first-party destination.

Which environments are exposed?

Any environment that builds or installs this package with pip may expose its hostname, even if the module is never imported. Hosts where the installed gcp_log_poc module is imported may also expose the hostname at import time.

How can I determine whether this package may be present?

Check whether expect-tests version 99.99.99 was installed or used in pip build or installation activity. Also check for imports of gcp_log_poc, because that module name does not match the package name and triggers the DNS behavior when imported.

MAL-2026-18760: Malicious code in expect-tests (PyPI)

Affected Software

Event History

Frequently Asked Questions

When can the hostname exfiltration occur?

What information is sent and where does it go?

Which environments are exposed?

How can I determine whether this package may be present?

Company

Resources

Contact

Frequently Asked Questions

When can the hostname exfiltration occur?

What information is sent and where does it go?

Which environments are exposed?

How can I determine whether this package may be present?