The bq-helix-recon-6ade983e package on PyPI contains malicious code that executes on every Python startup by placing PTH/sitecustomize files. This code collects sensitive information such as credential files, environment variables, and cloud metadata, then exfiltrates this data. The campaign associated with this package is clearly malicious, functioning as an infostealer targeting cloud tokens and other credentials.