If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (a2ec17985c3fbe65758a9d7be21bc3fad83c333c1e15a7ef09e5e5fe3b03ceca)
EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://dl[.]dropbox[.]com/s/tpykidpdjz99202/esquele[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1090710876639744062/1102575056925761587/bypass2[.]ps1 other packages →