If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (42cb6a5da5eb315080bb116111ea0ab235e3c90570cbb982190b948faedc3189)
EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://dl[.]dropbox[.]com/s/tpykidpdjz99202/esquele[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1090710876639744062/1102575056925761587/bypass2[.]ps1 other packages →