---
id: "MAL-2026-18396"
kind: "package"
aliases: ["MAL-2026-18396"]
title: "Malicious code in bq-helix-recon-6ade983e (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bq-helix-recon-6ade983e", "fixed": [], "affected": "= 0.1.0; = 0.1.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-29T19:56:11+00:00"
first_seen_at: "2026-10-29T20:55:48+00:00"
updated_at: "2026-10-29T21:06:22+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18396", "first_seen_at": "2026-10-29T20:55:48+00:00"}]
---

# Malicious code in bq-helix-recon-6ade983e (PyPI)

## Affected

- pypi:bq-helix-recon-6ade983e affected = 0.1.0; = 0.1.2 fixed ?

## Timeline

- 2026-10-29T20:55:48+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18396

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17)
Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-bq-helix-recon


Reasons (based on the campaign):


 - abuses-pth


 - exfiltration-cloud-tokens


 - exfiltration-generic


 - exfiltration-env-variables


 - exfiltration-credentials

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_