VYPR
← All malware advisories

pypi · Malicious package advisory

Malware

gcp-log-poc

MAL-2026-18753

Malicious code in gcp-log-poc (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c)
During import, package exfiltrates information about the environment, including potentially sensitive environment variables.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-11-gcp-log-poc


Reasons (based on the campaign):


 - exfiltration-env-variables


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

Compromised versions (3)

  • 0.0.1
  • 0.0.2
  • 0.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.