MAL-2026-15810
Vulnerability from ossf_malicious_packages
Published
2026-09-01 16:19
Modified
2026-09-09 03:23
Summary
Malicious code in gcphelpit (PyPI)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d)
The module src/gcphelpit/verify.py runs at import time: it reads the installer's ~/.zshrc and POSTs the raw file contents to the hardcoded endpoint https://webhook.site/bc67d797-61ff-4f3b-a9b8-5df6a5e7643d. cli.py imports _verify at the top of the module and is wired as the declared gcphelpit console_script entry point, so the read-and-upload fires unconditionally on every CLI invocation. ~/.zshrc routinely contains exported cloud credentials and access tokens (AWS*, GOOGLE_APPLICATION_CREDENTIALS, GitHub/npm tokens), so the effect is bulk exfiltration of installer-owned shell secrets to a third-party public webhook collector that is unrelated to the package's advertised purpose as a GCP CLI audit helper.
Source: kam193 (d3e108475330381be537963456cb012b943f2d0a3693c83205f8f5b01f36635a)
During initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-gcphelpit
Reasons (based on the campaign):
- files-exfiltration
CWE
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "src/gcphelpit/_verify.py",
"sha256": "322d0c2e23a8da3fc8beb4e7e95c353351746c2d8dbd160e71cb87a64d669d92",
"tlsh": "1ae0f1abd4ed2201839101f0c90d7c986616e0197308b0280e1020f09d49e9f270617a"
}
],
"package_integrity": [
{
"filename": "gcphelpit-0.1.2-py3-none-any.whl",
"hashes": {
"blake2b_256": "234c8dec1d78530b081170719387d40635397c0b6e432e0ebe7a9e1af51dcf61",
"md5": "f6d44d0794d3277c782fb38eca082cfd",
"sha256": "d075072618f99c3add6cf6374f3975fa66670d729b7d2300b71fc0449142573a"
}
},
{
"filename": "gcphelpit-0.1.2.tar.gz",
"hashes": {
"blake2b_256": "cc38aba766f0e3797926eeb7243815958520f48e9568b150fffbc627fdf71c1b",
"md5": "a606dc681df87e9c0f71465c7e3f4222",
"sha256": "d1675309db87ddc8642f14385484b5e96d695bbd6a6f2bc691b78d69b3b375cd"
}
}
]
}
},
"package": {
"ecosystem": "PyPI",
"name": "gcphelpit"
},
"versions": [
"0.1.0",
"0.1.1",
"0.1.2"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "REPORTER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "pypi/2026-09-gcphelpit/gcphelpit",
"import_time": "2026-09-01T16:39:08.103916365Z",
"modified_time": "2026-09-01T16:19:02.685503Z",
"sha256": "d3e108475330381be537963456cb012b943f2d0a3693c83205f8f5b01f36635a",
"source": "kam193",
"versions": [
"0.1.0",
"0.1.1",
"0.1.2"
]
},
{
"id": "pypi/2026-09-gcphelpit/gcphelpit",
"import_time": "2026-09-01T20:18:24.540360285Z",
"modified_time": "2026-09-01T16:19:02.685503Z",
"sha256": "38e7bf3f1271f4094aa294a361c60b2bc393405a95b6f5f92eb86452c76c7ddf",
"source": "kam193",
"versions": [
"0.1.0",
"0.1.1",
"0.1.2"
]
},
{
"id": "IN-MAL-2026-019320",
"import_time": "2026-09-02T02:44:33.224498594Z",
"modified_time": "2026-09-02T02:19:06Z",
"sha256": "6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d",
"source": "amazon-inspector",
"versions": [
"0.1.2"
]
},
{
"id": "IN-MAL-2026-019829",
"import_time": "2026-09-09T03:21:58.142879311Z",
"modified_time": "2026-09-09T02:52:05Z",
"sha256": "aa212113ed4f70cf0cd8885a352193b48e51f86c091b8685564eafce1db1beed",
"source": "amazon-inspector",
"versions": [
"0.1.0"
]
},
{
"id": "IN-MAL-2026-019827",
"import_time": "2026-09-09T03:21:57.885128927Z",
"modified_time": "2026-09-09T02:51:40Z",
"sha256": "da147079d9f811a9e39999be430c7834fd525269a66a4f80a3bda57d140811b3",
"source": "amazon-inspector",
"versions": [
"0.1.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d)\nThe module src/gcphelpit/_verify.py runs at import time: it reads the installer\u0027s ~/.zshrc and POSTs the raw file contents to the hardcoded endpoint https://webhook.site/bc67d797-61ff-4f3b-a9b8-5df6a5e7643d. cli.py imports _verify at the top of the module and is wired as the declared `gcphelpit` console_script entry point, so the read-and-upload fires unconditionally on every CLI invocation. ~/.zshrc routinely contains exported cloud credentials and access tokens (AWS_*, GOOGLE_APPLICATION_CREDENTIALS, GitHub/npm tokens), so the effect is bulk exfiltration of installer-owned shell secrets to a third-party public webhook collector that is unrelated to the package\u0027s advertised purpose as a GCP CLI audit helper.\n\n## Source: kam193 (d3e108475330381be537963456cb012b943f2d0a3693c83205f8f5b01f36635a)\nDuring initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-gcphelpit\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n",
"id": "MAL-2026-15810",
"modified": "2026-09-09T03:23:51.696083550Z",
"published": "2026-09-01T16:19:02Z",
"references": [
{
"type": "WEB",
"url": "https://bad-packages.kam193.eu/pypi/package/gcphelpit"
},
{
"type": "WEB",
"url": "https://github.com/EliyaS-123/gcphelpit-cli/commit/0f330a199020f1f2e896c7bde9d35adbe8aa8fb5"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/gcphelpit/0.1.2/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/gcphelpit/0.1.0/"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/gcphelpit/0.1.1/"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in gcphelpit (PyPI)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…