query-profile 0.0.1

DEPENDENCY CONFUSION POC — This package name was unclaimed on PyPI. Claimed by security researcher to demonstrate the attack surface in Apple's ml-health-query-profiles repository.

query-profile

⚠️ DEPENDENCY CONFUSION PROOF OF CONCEPT ⚠️

This package name (query-profile) was identified as unclaimed on PyPI while being directly referenced in Apple's official open-source repository:

• Repository: apple/ml-health-query-profiles
• Affected file: docs/TUTORIAL.md
• Issue: The tutorial instructs users to run pip install query-profile, but Apple never published this package to PyPI.

This package is a harmless proof of concept — it does nothing except demonstrate that the package name was unclaimed and could be registered by an attacker. In a real attack, a malicious package under this name could:

• Steal OpenAI/Anthropic/Azure API keys
• Exfiltrate sensitive health query data
• Install backdoors or persistence mechanisms

---

This package was published for responsible disclosure purposes only. No malicious code is included.