If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (1ba602a97accda8e614fcf38d1af1cb7f1878bf2bd450b21f1be16a4c260123a)
Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://pastebin[.]com/raw/TwHdexDC other packages →
- hxxps://canary[.]discord[.]com/api/webhooks/1153431050517762059/MAkfrB4n1Gz6qe7W8ffWTZF92yfN3D_FWPFFaK_FBgDQWB1ZYfbKHa61X_8L6GK175r0 other packages →
- hxxps://canary[.]discord[.]com/api/webhooks/1155235432406196334/3eFtMXnG2laJjInzO_kAzLbW6ebMgbrrwmAcRtZyOfqnyCh-twTT9pSumcKr5QJvbGEZ other packages →
- hxxps://canary[.]discord[.]com/api/webhooks/1152716297474424913/z6-hvrQNeyL0m1Mm34JLYj1VVB67sVEXogqJzGCkxYgMFCgCWhQaR07ruMBck1dJAi9g other packages →
- hxxps://canary[.]discord[.]com/api/webhooks/1152648911371120681/JlL5FnwmY6nP6RaZxmQ7NI9MGR6HARmAekaPqPDdVTq9K3RJ68Lcd7cz16l9u6eZH9c3 other packages →
- hxxps://discord[.]com/api/webhooks/1103033150558457876/22oUF1rkDTdxz-iq-2EOR4aVXwDr5vFIeE9zWlitIbYSG2E3XhF8KQIzuo1uXy_bOcos other packages →
- hxxp://51[.]178[.]25[.]148:8081/upload other packages →
- hxxp://51[.]178[.]25[.]148:8081/dl/runtime other packages →
- hxxp://51[.]178[.]25[.]148:8081/uploader other packages →
- hxxp://51[.]178[.]25[.]148:8081/gethw other packages →
- hxxp://51[.]178[.]25[.]148:8081/dl/system other packages →
- hxxp://51[.]178[.]25[.]148:8081/getip other packages →
- hxxp://51[.]178[.]25[.]148:8081/dl/uwu other packages →
- hxxp://51[.]178[.]25[.]148:8081/rooter other packages →
- hxxp://51[.]178[.]25[.]148:8081/dl/sys86 other packages →
- hxxp://51[.]178[.]25[.]148:8081/dl/gamesdk other packages →
IP addresses
- 51[.]178[.]25[.]148 other packages →