If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (f918d3ae448737e8a58e16ad57af3037e27ba8ab02fef22ba6e0b4f6f2c49e1a)
Package automatically download and runs an executable, which then imitates a malicious action and requests ransom payment.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-10-makronlox
Reasons (based on the campaign):
- Downloads and executes a remote executable.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://www[.]dropbox[.]com/scl/fi/19qqc7egp8py7t7ov659m/123[.]exe?rlkey=oc0nbftrgxo4avtee5grwbmqi&st=8q0bp98n&dl=1 other packages →