A set of malicious PyPI packages that impersonate an internal Inditex Python framework ("Amiga") and its WiseCloud secrets-management clients, and ship one shared implant. When installed or imported inside a CI environment that matches the target's infrastructure, each package harvests CI/CD credentials (cloud, vault, registry and SCM tokens), reads the Kubernetes service-account token and Docker credentials, mints OIDC identity tokens, and opens a persistent channel to an external server that executes attacker-supplied shell commands and returns their output.