If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (3bd64da5911ab6ec28e1bc33993b363b52702ff6bb19a87b98f37267d0784664)
Package "uconst" is the package containing malicious code with multiple stage, exfiltrating basic info as well as browser data. It's put into others as dependency.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-08-uconst-old
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- The malicious code is intentionally included in a dependency of the package
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- lucky-tubes[.]000webhostapp[.]com other packages →
URLs
- hxxp://89[.]23[.]105[.]103:809/lin other packages →
- hxxp://89[.]23[.]105[.]103:809/win other packages →
- hxxp://89[.]23[.]105[.]103/eny other packages →
- hxxps://lucky-tubes[.]000webhostapp[.]com/log[.]php?data=sent other packages →
IP addresses
- 89[.]23[.]105[.]103 other packages →