If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (c6d463791b2f4dc4cdb8a0b3961dbb9b956fc3f0e0ad974fc407211ae9d2e3a8)
The attached DLL is infected with a very high detection rate
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-10-old-lwplugin
Reasons (based on the campaign):
- other