Malicious code in gcphelpit (PyPI)

The gcphelpit package includes a malicious module (_verify.py) that executes at import time. It reads the installer's ~/.zshrc file and posts its raw contents to a hardcoded external webhook URL unrelated to the package's stated purpose. The CLI entry point imports this module, causing the exfiltration to occur on every command invocation. This behavior results in the unauthorized disclosure of sensitive environment variables and tokens stored in ~/.zshrc, such as AWS, Google, GitHub, and npm credentials. Versions 0.1.0, 0.1.1, and 0.1.2 are affected. No official patch or remediation is indicated in the provided data.

The malicious code leads to the bulk exfiltration of sensitive shell secrets and credentials from the user's environment to an attacker-controlled endpoint. This compromises the confidentiality of cloud credentials and access tokens, potentially enabling unauthorized access to cloud resources and other services. The exfiltration occurs silently and automatically on every CLI invocation, increasing the risk of widespread credential leakage.

No official patch or remediation is documented in the provided information. Users should immediately uninstall the affected versions (0.1.0, 0.1.1, 0.1.2) of the gcphelpit package and avoid using it. Review and rotate any credentials or tokens that may have been exposed via the ~/.zshrc file. Monitor for any unauthorized access to cloud or service accounts associated with these credentials. Check for updated advisories or replacement packages from trusted sources before reinstalling similar functionality.