The pokee-data-utils PyPI package version 1.0.1 contains malicious code that harvests credentials and environment data during both installation and import. It reads sensitive internal host files and environment variables, outputs collected data to files and stdout, exposing partial provider credentials and internal host source. The package contains no legitimate utility code and is identified as a supply chain proof-of-concept with full impact. This behavior can lead to sensitive information disclosure in multi-tenant sandbox environments where workspace files are accessible.