Threats Tagged 'mal-2026-15810'
View all threats tagged with 'mal-2026-15810'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-15810'
Click on any threat for detailed analysis and mitigation recommendations
Malicious code in gcphelpit (PyPI) 0 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d) The module src/gcphelpit/_verify.py runs at import time: it reads the installer's ~/.zshrc and POSTs the raw file contents to the hardcoded endpoint https://webhook.site/bc67d797-61ff-4f3b-a9b8-5df6a5e7643d. cli.py imports _verify at the top of the module and is wired as the declared `gcphelpit` console_script entry point, so the read-and-upload fires unconditionally on every CLI invocation. ~/.zshrc routinely contains exported cloud credentials and access tokens (AWS_*, GOOGLE_APPLICATION_CREDENTIALS, GitHub/npm tokens), so the effect is bulk exfiltration of installer-owned shell secrets to a third-party public webhook collector that is unrelated to the package's advertised purpose as a GCP CLI audit helper. ## Source: kam193 (d3e108475330381be537963456cb012b943f2d0a3693c83205f8f5b01f36635a) During initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-gcphelpit Reasons (based on the campaign): - files-exfiltration Join the discussion | GCVE Database | 09/01/2026, 16:19:02 UTC Added: 09/02/2026, 15:48:51 UTC |
Showing 1 to 1 of 1 result