If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (4d54423199bee86602ae77e6da3d92100ce8d94494f9e1f6b56a0b14ae06f55c)
EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://dl[.]dropbox[.]com/s/tpykidpdjz99202/esquele[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1090710876639744062/1102575056925761587/bypass2[.]ps1 other packages →