gcphelpit

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (d3e108475330381be537963456cb012b943f2d0a3693c83205f8f5b01f36635a)
During initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-gcphelpit


Reasons (based on the campaign):


 - files-exfiltration

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5e649f3e7ae99bc130814075a7ba7e5fb7d6c3c3/osv/malicious/pypi/gcphelpit/MAL-2026-15810.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/gcphelpit
- https://github.com/ossf/malicious-packages/blob/5e649f3e7ae99bc130814075a7ba7e5fb7d6c3c3/osv/malicious/pypi/gcphelpit/MAL-2026-15810.json
- https://github.com/EliyaS-123/gcphelpit-cli/commit/0f330a199020f1f2e896c7bde9d35adbe8aa8fb5
- https://github.com/ossf/malicious-packages/blob/d46c5cde5fb30ba91b8f4969a457a5a61ff9e7c2/osv/malicious/pypi/gcphelpit/MAL-2026-15810.json
- https://github.com/ossf/malicious-packages/blob/ca35a319f3c5255ac2d7f28cf58023d75de17a35/osv/malicious/pypi/gcphelpit/MAL-2026-15810.json
- https://pypi.org/project/gcphelpit/0.1.2
- https://github.com/ossf/malicious-packages/blob/3483fc1bf23dd0386426587272fe2080b57cf9dd/osv/malicious/pypi/gcphelpit/MAL-2026-15810.json
- https://pypi.org/project/gcphelpit/0.1.0

Compromised versions (1)

• = 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.