If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (792748013463fb0303ff6033b47dcb48c23dc944d5075a8859b6997eafd47a56)
The file bc2556d1c1ea2a2d00.js contains an AdWare LNKR, this file is included in read_article.html template and effectively used when the user requests to see the downloaded article in the webbrowser (function "read" from instaread.py). Note: the template may have been copied from the website, so 'maybe' including adware is unintentional.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-10-old-instaread
Reasons (based on the campaign):
- action-hidden-in-lib-usage
- The package is used to advertise a service or product.