If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (2f9270a5372d17332c32e8824c44dab167a1f2a78ebc5a204e090ac4487a0f31)
Package clones a legitimate package. In the call to check the current version, the obfuscated remote code is downloaded and executed. It appears to be an infostealer
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-11-asn1tool
Reasons (based on the campaign):
- obfuscation
- dependency-confusion
- typosquatting
- clones-real-package
- infostealer
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://tinyurl[.]com/1atestver other packages →
- hxxps://tinyurl[.]com/l4kr0sr4t other packages →
- hxxps://tinyurl[.]com/w1ngfjs other packages →