{"id":"MAL-2026-18753","summary":"Malicious code in gcp-log-poc (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c)\nDuring import, package exfiltrates information about the environment, including potentially sensitive environment variables.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-gcp-log-poc\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n","modified":"2026-11-07T20:15:03.208043931Z","published":"2026-11-07T19:53:11Z","database_specific":{"malicious-packages-origins":[{"sha256":"2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c","source":"kam193","versions":["0.0.1","0.0.2","0.0.3"],"id":"pypi/2026-11-gcp-log-poc/gcp-log-poc","import_time":"2026-11-07T20:11:09.562190877Z","modified_time":"2026-11-07T19:53:11.215199Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/gcp-log-poc"}],"affected":[{"package":{"name":"gcp-log-poc","ecosystem":"PyPI","purl":"pkg:pypi/gcp-log-poc"},"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gcp-log-poc/MAL-2026-18753.json"}}],"schema_version":"1.9.2","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}