MAL-2026-18395: Malicious code in bq-helix-build-hook-6ade983e (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (d2ff13fe63e15fdf4130e7219776edbe4d34fe2c2b83011099a0ddec9c10ebf6) On pip install, setup.py collects the full process environment (dict(os.environ)), process command lines, and /proc/self/{status,cgroup,mountinfo,fd}, and queries the GCP instance metadata service at http://169.254.169.254/computeMetadata/v1/ (with the required Metadata-Flavor: Google header) for the default service account's token, email, scopes, and project id. The collected JSON blob is sent to a hardcoded remote endpoint at 34.45.253.92 — both as an HTTP POST to http://34.45.253.92:8080/bq-sdist-hook-... and over a raw TCP socket to 34.45.253.92:1234. The destination IP is unrelated to any legitimate publisher infrastructure and the behavior fires automatically from the build backend during installation.
Source: kam193 (ee26602dfa25f574d440b2c1e8ef0a9516fdfb5db4b59f995b88784332476413) During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-bq-helix-recon
Reasons (based on the campaign):
- abuses-pth
- exfiltration-cloud-tokens
- exfiltration-generic
- exfiltration-env-variables
- exfiltration-credentials
Affected Software
Event History
Frequently Asked Questions
Is a standard installation enough to trigger the malicious behavior?
Yes. The behavior runs automatically from the build backend during pip installation; no post-install execution or special configuration is described.
Which environments are at greatest risk of credential exposure?
Systems with sensitive environment variables or credential files are exposed. Google Cloud environments are particularly at risk because the code queries the GCP metadata service for the default service account token, email, scopes, and project ID.
What access does an attacker need to exploit this package?
The package only needs to be installed through pip. Its installation code collects local process and system information and attempts to retrieve cloud metadata without requiring additional user interaction.
How can I investigate whether an installation attempted exfiltration?
Review installation-time network activity for HTTP connections to 34.45.253.92:8080, including paths beginning with /bq-sdist-hook-, and raw TCP connections to 34.45.253.92:1234. Also investigate whether the affected installation ran in an environment containing credentials, environment secrets, or accessible GCP metadata.