If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (680952d0c459a4f45563f58f0e5b7c84b80acaf0ee6f35936b33fedd36cb77b7)
EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://dl[.]dropbox[.]com/s/tpykidpdjz99202/esquele[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1090710876639744062/1102575056925761587/bypass2[.]ps1 other packages →