gcp-log-poc

GHSA-3qwc-2vj2-6vc8

Malicious code in gcp-log-poc (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1`

## Source: kam193 (2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c)
During import, package exfiltrates information about the environment, including potentially sensitive environment variables.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-11-gcp-log-poc


Reasons (based on the campaign):


 - exfiltration-env-variables


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c4482824701d9fa20ce735a0c498fe88d876aa81/osv/malicious/pypi/gcp-log-poc/MAL-2026-18753.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/gcp-log-poc
- https://github.com/ossf/malicious-packages/blob/c4482824701d9fa20ce735a0c498fe88d876aa81/osv/malicious/pypi/gcp-log-poc/MAL-2026-18753.json
- https://github.com/advisories/GHSA-3qwc-2vj2-6vc8

Compromised versions (1)

= 0.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.