A malicious package named gcp-log-poc has been identified on PyPI, a Python package repository. The package contains code that exfiltrates sensitive environment information, including IP addresses and usernames, when imported. This poses a risk to developers who use the package, potentially allowing attackers to steal sensitive data.