MAL-2026-18396

Dashboard / Malicious Package / MAL-2026-18396

MAL-2026-18396

Summary: Malicious code in bq-helix-recon-6ade983e (PyPI)

Details: Source: amazon-inspector (3a2ea78473cb414982a67f3fa93db3427b98c6e3bcc5d70f6bbb0ededba7791e) The package ships bq_helix_recon.pth plus sitecustomize.py/usercustomize.py that invoke bootstrap() on every Python interpreter start — including pip's own subsequent interpreter invocations immediately after install — with no import or user action required. The bootstrap payload collects the full process environment (dict(os.environ)), hostname/uid/user, /proc/self/* entries (cmdline, status, cgroup, mountinfo, net/tcp, fds, namespaces), and walks /, /workspace, /root, /home, and /tmp. It also queries the GCE metadata server at 169.254.169.254 for instance/service-accounts/default/token and reads credential files including /root/.docker/config.json, application_default_credentials.json, and the file referenced by GOOGLE_APPLICATION_CREDENTIALS. The collected data is POSTed in cleartext to http://34.45.253.92:8080/bq-helix-recon-6ade983e and sent over TCP to 34.45.253.92:1234. SystemExit is raised in non-runtime phases to further ensure persistent recon execution. Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17) Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-bq-helix-recon Reasons (based on the campaign): - abuses-pth - exfiltration-cloud-tokens - exfiltration-generic - exfiltration-env-variables - exfiltration-credentials

References: https://bad-packages.kam193.eu/pypi/package/bq-helix-recon-6ade983e, https://pypi.org/project/bq-helix-recon-6ade983e/0.1.0/, https://pypi.org/project/bq-helix-recon-6ade983e/0.1.2/