{"id":"MAL-2026-18753","kind":"package","aliases":["MAL-2026-18753"],"related":[],"title":"Malicious code in gcp-log-poc (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c)\nDuring import, package exfiltrates information about the environment, including potentially sensitive environment variables.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-gcp-log-poc\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gcp-log-poc","fixed":[],"affected":"= 0.0.1; = 0.0.2; = 0.0.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T19:53:11+00:00","first_seen_at":"2026-11-07T20:49:55+00:00","triaged_at":"2026-11-07T20:50:49+00:00","updated_at":"2026-11-07T20:51:52+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':58C '-18753':11A,14A '-2026':10A,13A '2026':57C '2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c':32C 'base':64C 'basic':78C 'campaign':49C,56C,67C 'categori':46C 'clear':51C 'code':2A,75C 'contain':74C 'data':79C 'detail':23C 'edit':26C 'env':70C 'environ':40C,44C 'exfiltr':36C,69C,77C 'exfiltration-env-vari':68C 'gcp':5A,16A,60C 'gcp-log-poc':4A,15A,59C 'import':34C 'includ':41C 'inform':37C 'infosteal':55C 'intent':53C 'ip':84C 'kam193':31C 'like':54C,83C 'limit':90C 'line':29C 'log':6A,17A,61C 'mal':9A,12A 'malici':1A,19B,47C,52C 'packag':20B,35C,73C 'per':21C 'poc':7A,18A,62C 'potenti':42C 'pypi':8A 'reason':63C 'risk':91C 'sensit':43C 'sourc':22C,30C 'system':82C 'usernam':86C 'variabl':45C,71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["gcplogpoc"],"ptokens":["gcp","log","poc"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18753':11A,14A '-2026':10A,13A 'code':2A 'gcp':5A,16A 'gcp-log-poc':4A,15A 'log':6A,17A 'mal':9A,12A 'malici':1A 'poc':7A,18A 'pypi':8A","search_b":"'malici':19B 'packag':20B","search_c":"'-11':58C '2026':57C '2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c':32C 'base':64C 'basic':78C 'campaign':49C,56C,67C 'categori':46C 'clear':51C 'code':75C 'contain':74C 'data':79C 'detail':23C 'edit':26C 'env':70C 'environ':40C,44C 'exfiltr':36C,69C,77C 'exfiltration-env-vari':68C 'gcp':60C 'gcp-log-poc':59C 'import':34C 'includ':41C 'inform':37C 'infosteal':55C 'intent':53C 'ip':84C 'kam193':31C 'like':54C,83C 'limit':90C 'line':29C 'log':61C 'malici':47C,52C 'packag':35C,73C 'per':21C 'poc':62C 'potenti':42C 'reason':63C 'risk':91C 'sensit':43C 'sourc':22C,30C 'system':82C 'usernam':86C 'variabl':45C,71C","first_public_at":"2026-11-07T19:53:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18753","url":"https://osv.dev/vulnerability/MAL-2026-18753","severity":"critical","published_at":"2026-11-07T19:53:11+00:00","modified_at":"2026-11-07T20:15:03+00:00","first_seen_at":"2026-11-07T20:49:55+00:00","fetched_at":"2026-11-07T20:49:55+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}