NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

gt-tester-exp-profiler-exp-00000017PyPI

Advisory published Updated

gt-tester-exp-profiler-exp-00000017 is a confirmed malicious PyPI package (MAL-2026-4753) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gt-tester-exp-profiler-exp-00000017 (PyPI)

MAL-2026-4753
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
pip uninstall gt-tester-exp-profiler-exp-00000017

What this malware does

setup.py installs a site-wide.pth file (gt_tester_exp_profiler_exp_00000017_probe.pth) into site-packages that imports the package's probe module and calls run_probe() at every Python interpreter startup. probe.py performs a plaintext HTTP GET to the bare IP 104.236.116.157 with a per-call random hex tag, fingerprinting the installer's machine to a third party on every Python invocation — not just when the package is explicitly imported. The User-Agent string claims an 'Academic research study' but no consent is obtained at install or runtime. Package metadata is a generic placeholder with no author, homepage, or publisher identification, and the destination is a bare IP not associated with any declared publisher. The.pth mechanism converts what would be an import-time call into persistent host beaconing across every CI job, virtualenv activation, and script execution on the machine.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

f1490f970bd52c80c89f33029f9e875f1fb595014621d50e0ce87a167d1cd348

Detection & response playbook

Backdoor / remote access

  1. Find it

    Search your lockfiles and build artifacts for gt-tester-exp-profiler-exp-00000017 (version 1.0.0).

  2. If you installed it — respond

    gt-tester-exp-profiler-exp-00000017 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If gt-tester-exp-profiler-exp-00000017 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. gt-tester-exp-profiler-exp-00000017 on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004175

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks gt-tester-exp-profiler-exp-00000017-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
gt-tester-exp-profiler-exp-00000017 (PyPI) malicious package — MAL-2026-4753 | O3 Security