MAL-2026-18395Critical▾ Abyssal⚠ Exploited in the wildMalicious code in bq-helix-build-hook-6ade983e (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
-= Per source details. Do not edit below this line.=-
On pip install, setup.py collects the full process environment (dict(os.environ)), process command lines, and /proc/self/{status,cgroup,mountinfo,fd}, and queries the GCP instance metadata service at http://169.254.169.254/computeMetadata/v1/ (with the required Metadata-Flavor: Google header) for the default service account's token, email, scopes, and project id. The collected JSON blob is sent to a hardcoded remote endpoint at 34.45.253.92 — both as an HTTP POST to http://34.45.253.92:8080/bq-sdist-hook-... and over a raw TCP socket to 34.45.253.92:1234. The destination IP is unrelated to any legitimate publisher infrastructure and the behavior fires automatically from the build backend during installation.
During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-bq-helix-recon
Reasons (based on the campaign):
abuses-pth
exfiltration-cloud-tokens
exfiltration-generic
exfiltration-env-variables
exfiltration-credentials
bq-helix-build-hook-6ade983eRefer to the advisory for the patched release.