pokee-data-utils (PyPI) · Malicious Code
Affects pokee-data-utilsSource GCVE Database
Malicious package : remove pokee-data-utils and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:32 UTC
Malicious package
Published to PyPI · OSV MAL-2026-10547
What to do
Remove pokee-data-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIpokee-data-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The pokee-data-utils PyPI package version 1.0.1 contains malicious code that harvests credentials and environment data during both installation and import. It reads sensitive internal host files and environment variables, outputs collected data to files and stdout, exposing partial provider credentials and internal host source. The package contains no legitimate utility code and is identified as a supply chain proof-of-concept with full impact. This behavior can lead to sensitive information disclosure in multi-tenant sandbox environments where workspace files are accessible.