The bq-helix-build-hook-6ade983e package on PyPI version 0.1.0 contains malicious code that collects sensitive information from the environment during installation. This includes credential files, environment variables, and data from cloud metadata endpoints, which are then exfiltrated. The campaign associated with this malware is identified as 2026-10-bq-helix-recon and is characterized by clear malicious intent to steal information.