Supply-chain threat intelligence
Incident detail
criticalpypi·credential theft·osv
Malicious code in quant-backtest-helpers (PyPI)
Risk score
92
AI summary
Indexed incident for quant-backtest-helpers (pypi).
Description
During import, package exfiltrates environment variables and cloud tokens to a hardcoded location.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-quant-backtest-helpers
Reasons (based on the campaign):
exfiltration-env-variables
exfiltration-cloud-tokens
Technical details
Indicators
- affected version<function fixed() { [native code] }75%
Timeline
- Advisory published
- Indexed by ThreatPkg