---
id: MAL-2026-16098
title: Malicious code in bq-build-probe-vrp-2026 (PyPI)
summary: Malicious code in bq-build-probe-vrp-2026 (PyPI)
severity: critical
exploited: true
vendor: bq-build-probe-vrp-2026
product: bq-build-probe-vrp-2026
ecosystem: pip
affected:
  - bq-build-probe-vrp-2026
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T19:30:05.399495940Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-16098'
references:
  - url: 'https://pypi.org/project/bq-build-probe-vrp-2026/0.2.0/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-09-10T03:08:29.631Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65)
setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the GCE metadata service-account email (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email), plus sandbox-fingerprinting signals (docker socket presence at /var/run/docker.sock, outbound reachability via socket connect to 8.8.8.8:53). The collected data is written to _build_findings.json inside the installed package, and __init__.py exposes get_build_findings() to read it back. In a CI/build environment, os.environ typically contains build secrets (CI tokens, cloud credentials, service-account material); embedding that dump inside the built artifact and providing a retrieval API turns any subsequent import or redistribution of the wheel into a channel for the harvested secrets. The package's self-description as authorized VRP testing does not change the mechanism.


## Affected packages

- `bq-build-probe-vrp-2026`

## Remediation

Refer to the advisory for the patched release.