The gcp-log-poc package on PyPI contains malicious code that exfiltrates environment information, including potentially sensitive environment variables, during import. This behavior is intended to steal basic system data such as IP address and username. The package versions 0.0.1, 0.0.2, and 0.0.3 are affected. The risk is considered limited but clearly malicious.