MAL-2026-18396: Malicious code in bq-helix-recon-6ade983e (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (3a2ea78473cb414982a67f3fa93db3427b98c6e3bcc5d70f6bbb0ededba7791e) The package ships bqhelixrecon.pth plus sitecustomize.py/usercustomize.py that invoke bootstrap() on every Python interpreter start — including pip's own subsequent interpreter invocations immediately after install — with no import or user action required. The bootstrap payload collects the full process environment (dict(os.environ)), hostname/uid/user, /proc/self/ entries (cmdline, status, cgroup, mountinfo, net/tcp, fds, namespaces), and walks /, /workspace, /root, /home, and /tmp. It also queries the GCE metadata server at 169.254.169.254 for instance/service-accounts/default/token and reads credential files including /root/.docker/config.json, applicationdefaultcredentials.json, and the file referenced by GOOGLEAPPLICATIONCREDENTIALS. The collected data is POSTed in cleartext to http://34.45.253.92:8080/bq-helix-recon-6ade983e and sent over TCP to 34.45.253.92:1234. SystemExit is raised in non-runtime phases to further ensure persistent recon execution.
Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17) Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-bq-helix-recon
Reasons (based on the campaign):
- abuses-pth
- exfiltration-cloud-tokens
- exfiltration-generic
- exfiltration-env-variables
- exfiltration-credentials
Affected Software
Event History
Frequently Asked Questions
What must occur for the payload to run?
Installing the package is sufficient. Its .pth file and sitecustomize.py/usercustomize.py invoke bootstrap() on every Python interpreter start, including subsequent pip interpreter invocations, without an import or user action.
What information could be exposed from an affected environment?
The payload collects process environment variables, host and user identifiers, multiple /proc/self entries, filesystem contents under /, /workspace, /root, /home, and /tmp, and selected credential files. It also attempts to obtain a GCE service-account token from the metadata server and reads the file named by GOOGLE_APPLICATION_CREDENTIALS.
How can ongoing execution or data exfiltration be identified?
Check the installed package for bq_helix_recon.pth and sitecustomize.py or usercustomize.py. Review network telemetry for cleartext HTTP POST requests to 34.45.253.92:8080/bq-helix-recon-6ade983e or TCP connections to 34.45.253.92:1234 when Python or pip runs.