If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d5cb2d30b1084d16cbffd08a377d8723d794f112d1d33e666a4d4154653015e0)
Imitate legit package, when used, sends out the URL of web application using the package
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-08-app-url-to-telegram
Reasons (based on the campaign):
- clones-real-package
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- dependency-confusion
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]telegram[.]org/bot7168168551:AAEmMGUSJ_Pd7l6YAMQs-ySXM1FXueUOJtY/sendMessage?chat_id=6977902769&text= other packages →