bq-build-probe-vrp-2026

Details

**Severity:** Critical

**Affected versions:** `= 0.2.0`

## Source: amazon-inspector (46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65)
setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the GCE metadata service-account email (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email), plus sandbox-fingerprinting signals (docker socket presence at /var/run/docker.sock, outbound reachability via socket connect to 8.8.8.8:53). The collected data is written to _build_findings.json inside the installed package, and __init__.py exposes get_build_findings() to read it back. In a CI/build environment, os.environ typically contains build secrets (CI tokens, cloud credentials, service-account material); embedding that dump inside the built artifact and providing a retrieval API turns any subsequent import or redistribution of the wheel into a channel for the harvested secrets. The package's self-description as authorized VRP testing does not change the mechanism.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/2b1c1f9c745e34b30f0268524402701c7d1febca/osv/malicious/pypi/bq-build-probe-vrp-2026/MAL-2026-16098.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/2b1c1f9c745e34b30f0268524402701c7d1febca/osv/malicious/pypi/bq-build-probe-vrp-2026/MAL-2026-16098.json
- https://pypi.org/project/bq-build-probe-vrp-2026/0.2.0
- https://github.com/advisories/GHSA-f69f-h5mx-9x8p

Compromised versions (1)

• = 0.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.