If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (c2fdb66a75c58bc11250d088e141d39a4d2bbf8be018db9bb0ca9fd219d7e257)
Clones real package and hoddens an obfuscated code trying to run remote scripts as well as establish backdoor through SSH.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-08-fireindahole.fun
Reasons (based on the campaign):
- backdoor
- action-hidden-in-lib-usage
- clones-real-package
- obfuscation
- dependency-confusion
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- fireindahole[.]fun other packages →
URLs
- hxxp://main[.]fireindahole[.]fun/script4separator[.]sh other packages →
- hxxp://main[.]fireindahole[.]fun/script3separator[.]sh other packages →
- hxxps://grabify[.]link/IFKU0H other packages →