{"id":"MAL-2026-18396","kind":"package","aliases":["MAL-2026-18396"],"related":[],"title":"Malicious code in bq-helix-recon-6ade983e (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17)\nPackage places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-bq-helix-recon\n\n\nReasons (based on the campaign):\n\n\n - abuses-pth\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-generic\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-credentials","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bq-helix-recon-6ade983e","fixed":[],"affected":"= 0.1.0; = 0.1.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T19:56:11+00:00","first_seen_at":"2026-10-29T20:55:48+00:00","triaged_at":"2026-10-29T20:57:18+00:00","updated_at":"2026-10-29T21:06:22+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':82C '-18396':12A,15A '-2026':11A,14A '2026':81C '6ade983e':8A,20A '9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17':34C 'abus':93C 'abuses-pth':92C 'base':88C 'bq':5A,17A,84C 'bq-helix-recon':83C 'bq-helix-recon-6ade983e':4A,16A 'campaign':73C,80C,91C 'categori':70C 'clear':75C 'cloud':63C,97C 'code':2A,43C,49C 'collect':51C 'credenti':57C,108C 'data':61C 'detail':25C 'edit':28C 'endpoint':65C 'env':104C 'environ':55C,59C 'everi':45C 'execut':40C 'exfiltr':68C,96C,100C,103C,107C 'exfiltration-cloud-token':95C 'exfiltration-credenti':106C 'exfiltration-env-vari':102C 'exfiltration-gener':99C 'file':38C,58C 'final':67C 'generic':101C 'helix':6A,18A,85C 'includ':56C 'inform':52C 'infosteal':79C 'intent':77C 'kam193':33C 'like':78C 'line':31C 'mal':10A,13A 'malici':1A,21B,42C,71C,76C 'metadata':64C 'packag':22B,35C 'per':23C 'place':36C 'pth':94C 'pth/sitecustomize':37C 'pypi':9A 'python':46C 'reason':87C 'recon':7A,19A,86C 'sourc':24C,32C 'startup':47C 'token':98C 'trigger':39C 'variabl':60C,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T19:56:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18396","url":"https://osv.dev/vulnerability/MAL-2026-18396","severity":"critical","published_at":"2026-10-29T19:56:11+00:00","modified_at":"2026-10-29T20:30:02+00:00","first_seen_at":"2026-10-29T20:55:48+00:00","fetched_at":"2026-10-29T20:55:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}