bq-helix-recon-6ade983e@0.1.2

Summary

Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-bq-helix-recon Reasons (based on the campaign): - abuses-pth - exfiltration-cloud-tokens - exfiltration-generic - exfiltration-env-variables - exfiltration-credentials

Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17)