If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (314b140727c2d65586134b9e2722bdbba66be25e0f391d1b886cc08824783c63)
Running the module starts an infostealer attempting to exfiltrate credentials from webbrowsers
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-sunrequests
Reasons (based on the campaign):
- infostealer
- A Telegram webhook is used to send collected data.
- dependency-confusion