MAL-2026-18753: Malicious code in gcp-log-poc (PyPI)

Published Nov 7, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c) During import, package exfiltrates information about the environment, including potentially sensitive environment variables.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-gcp-log-poc

Reasons (based on the campaign):

- exfiltration-env-variables

- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

Affected Software

1 affected component

pip/gcp-log-poc=0.0.1, =0.0.2, =0.0.3

Event History

Nov 7, 2026

Advisory Published

via OSV·07:53 PM

Data Sourced

via OSV·07:53 PM

DescriptionAffected Software

Frequently Asked Questions

What actions trigger the malicious behavior?

The package exfiltrates environment information during import. This includes potentially sensitive environment variables, so exposure can occur when code imports the package rather than only when a specific function is called.

What information may be exposed?

The reported behavior includes exfiltration of environment data, potentially including sensitive environment variables. The campaign information also indicates collection of basic system data such as IP address or username.

MAL-2026-18753: Malicious code in gcp-log-poc (PyPI)

Affected Software

Event History

Frequently Asked Questions

What actions trigger the malicious behavior?

What information may be exposed?

Company

Resources

Contact

Frequently Asked Questions

What actions trigger the malicious behavior?

What information may be exposed?