Live › package › MAL-2026-18396
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-10-29 20:55 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| bq-helix-recon-6ade983e | pypi | = 0.1.0; = 0.1.2 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-bq-helix-recon
Reasons (based on the campaign):
abuses-pth
exfiltration-cloud-tokens
exfiltration-generic
exfiltration-env-variables
exfiltration-credentials
This page as .md · .json · in your agent: get_signal("MAL-2026-18396")