{"items":[{"id":"NVI-00008677","kind":"supply_chain_event","title":"Malicious code in bq-helix-recon-6ade983e (PyPI)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9r7r-h4fq-xj8p"],"plain_summary":"GitHub lists this malware advisory for bq-helix-recon-6ade983e, bq-helix-recon-6ade983e. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a85047dd12a84b2581bf1fb10f8aec7a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a85047dd12a84b2581bf1fb10f8aec7a","url":"https://github.com/advisories/GHSA-9r7r-h4fq-xj8p","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-9r7r-h4fq-xj8p","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:19.280Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a85047dd12a84b2581bf1fb10f8aec7a"],"technology":"bq-helix-recon-6ade983e","known_exclusions":[],"conditions_summary":"## Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17)\nPackage places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-bq-helix-recon\n\n\nReasons (based on the campaign):\n\n\n - abuses-pth\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-generic\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-credentials\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 0.1.0"]},{"certainty":"source_listed","source_ids":["sr-a85047dd12a84b2581bf1fb10f8aec7a"],"technology":"bq-helix-recon-6ade983e","known_exclusions":[],"conditions_summary":"## Source: kam193 (9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17)\nPackage places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-bq-helix-recon\n\n\nReasons (based on the campaign):\n\n\n - abuses-pth\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-generic\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-credentials\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 0.1.2"]}],"null_published_at":"2026-10-31T22:13:27.106Z","source_updated_at":"2026-10-30T15:31:30.000Z","source_disclosed_at":"2026-10-29T21:30:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:19.280Z"}],"next_cursor":null,"snapshot_revision":"42594"}