2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
Two malicious PyPI packages, bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e, were published to the GitHub Advisory Database on 2026-10-29 as part of the 2026-10-bq-helix-recon campaign. bq-helix-build-hook-6ade983e (0.1.0) runs an infostealer during installation, collecting credential files, environment variables and cloud metadata endpoint data before exfiltrating it. bq-helix-recon-6ade983e (0.1.0, 0.1.2) additionally drops PTH/sitecustomize files that trigger the malicious code on every Python startup, giving persistence beyond the initial install. Both abuse the .pth mechanism and exfiltrate cloud tokens, generic data, environment variables and credentials. No patched versions exist; any installation of these packages constitutes compromise of the build or runtime environment.
What to do
- Immediately uninstall and purge bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e from all environments and CI caches
- Rotate all credentials, cloud tokens and API keys present on affected machines, including cloud metadata-issued tokens
- Rebuild affected environments from clean images; remove any .pth or sitecustomize files the packages dropped
- Audit pip install logs and dependency lockfiles for these package names
- Block the package names in PyPI proxies/mirrors and dependency-scanning tooling
Sources
All live incidents on Threat Watch
