gcp-log-poc PyPI malware: import-time exfiltration of environment variables (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-07
OpenSSF and GitHub Advisory Database report the PyPI package gcp-log-poc as malicious code (GHSA-3qwc-2vj2-6vc8, CWE-506). On import, the package exfiltrates environment information, including potentially sensitive environment variables, plus basic system data such as IP address and username. Versions 0.0.1, 0.0.2 and 0.0.3 are affected; no patched versions exist and the package should be treated as malware. Anyone who installed or imported the package is affected and should assume environment secrets were stolen. Remediation is removal of the package and rotation of any credentials exposed via environment variables.
What to do
- Remove gcp-log-poc from all environments and block it in dependency policies
- Rotate any credentials, tokens or API keys that were present in environment variables on affected machines
- Audit logs and network egress for signs of exfiltration from affected hosts
- Scan dependency lockfiles and CI caches for the package and rebuild from clean images
Sources
All live incidents on Threat Watch
