# gcp-log-poc (PyPI) malicious package — MAL-2026-18753 | O3 Security

Malicious package

# gcp-log-pocPyPI

Advisory published Nov 7, 2026·Updated Nov 7, 2026

gcp-log-poc is a confirmed malicious PyPI package (MAL-2026-18753) that steals credentials and exfiltrates sensitive data (malicious versions 0.0.1, 0.0.2, 0.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gcp-log-poc (PyPI)

MAL-2026-18753

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall gcp-log-poc

## What this malware does

During import, package exfiltrates information about the environment, including potentially sensitive environment variables.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-gcp-log-poc

Reasons (based on the campaign):

-   exfiltration-env-variables
    
-   The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
    

## Malicious versions

3 flagged

0.0.10.0.20.0.3

## Indicators of compromise (SHA-256)

2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c

## Detection & response playbook

Credential / info stealer

1.  ### Find it
    
    Search your lockfiles and build artifacts for gcp-log-poc (3 malicious versions).
    
2.  ### If you installed it — respond
    
    gcp-log-poc is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
    
3.  ### Did it already run?
    
    If gcp-log-poc was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
    

## Frequently asked questions

No. gcp-log-poc on PyPI has been identified as a malicious package (versions 0.0.1, 0.0.2, 0.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

## Campaign

2026-11-gcp-log-poc

## References

-   [bad-packages.kam193.eu](https://bad-packages.kam193.eu/pypi/package/gcp-log-poc)

## Credits

-   Kamil Mańkowski (kam193) · reporter

## Detect & block this

O3 blocks gcp-log-poc\-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

[Malware detection](/malware-detection) [Runtime egress monitoring](/egress-monitor)

## Explore

[All malware advisories](/malware) [How O3 detects malware](/malware-database) [Vulnerability database](/vulnerability)