If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a)
The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by people and sends them to a Discord webhook, effectively allowing stealing data.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-old-easypydb
Reasons (based on the campaign):
- action-hidden-in-lib-usage
- exfiltration-generic
-
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/846019171992862750/t3AJQZ-fE-TrUlnE5tMm1FFw9KrAIJ6MkaokcCz4YP8sRDwy9g9z8VSMdCeXwUF4UwUv other packages →