Malicious Code Exfiltration in get-incorrect-name-bob Package
Summary
MAL-2026-862: Malicious code in get-incorrect-name-bob (PyPI). Affects get-incorrect-name-bob versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The get-incorrect-name-bob package is a Python library available on PyPI, designed to mimic a dummy MCP server. Its primary function is misleading, as it is intended to exfiltrate sensitive information such as the hostname upon import. This behavior poses a significant risk to users who may unknowingly install the package, believing it to be benign.
Vulnerability Detail
The vulnerability in the get-incorrect-name-bob package arises from its malicious code that executes during installation. Specifically, the package overrides the install command in setup.py to run code that exfiltrates basic system data, including the user's IP address and username. This behavior is indicative of a typical pentesting package but carries the risk of unauthorized data access and potential exploitation by malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall get-incorrect-name-bobIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid installing the get-incorrect-name-bob package altogether. If it is already installed, remove it immediately and monitor your system for any unusual activity. Additionally, consider using a virtual environment to isolate your projects and minimize the risk of exposure to malicious packages.
Conclusion
The get-incorrect-name-bob package poses a significant security risk due to its malicious code that exfiltrates sensitive information upon installation. Users are advised to uninstall the package immediately and remain vigilant for any unusual system behavior. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for get-incorrect-name-bob →
FAQ
It is a Python package that pretends to be a dummy MCP server but is designed to exfiltrate sensitive information from the user's system.
The package overrides the install command in setup.py to execute code that collects and sends basic system data, such as the hostname, IP address, and username.
Immediately uninstall the package using 'pip uninstall get-incorrect-name-bob' and monitor your system for any suspicious activity.
Currently, there is no safe version of the get-incorrect-name-bob package. It is recommended to avoid using it altogether.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application for vulnerabilities using the Vulert playground without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
