If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (bab4a414e51f614858ff935138ccb2632b0ba1801566c398a699e692715ccaae)
The obfuscated code in setup.py on installation collects information about the system (all possible about hardware, available resources, IP, names, etc.) and sends to a telegram webhook.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-website-scanner
Reasons (based on the campaign):
- exfiltration-generic
- obfuscation
- A Telegram webhook is used to send collected data.
Source: ossf-package-analysis (06dde0f250e5ce430d8501b6cecadc7839daed79bdaf46415c8c59f53114fab8)
The OpenSSF Package Analysis project identified 'website-scanner' @ 1.0.0 (pypi) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]telegram[.]org/bot7140748891:AAER8n1iFArAAMlK1dUdPeAs6sRi8vK6QgU/sendMessage other packages →