If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (599ccc7096fc2c86f54b4ef695dfe8fb97e9546771d9e24f58f0395e0b55c9c5)
EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://dl[.]dropbox[.]com/s/tpykidpdjz99202/esquele[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1090710876639744062/1102575056925761587/bypass2[.]ps1 other packages →