If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (3b45aebce3647704ac54d30a38e86493e0246f9ea44131394f84628656ef00ed)
Package uses the name as popular NPM package (https://www.npmjs.com/package/browser-run), but the only thing it does is adding a hardcoded public SSH key and then calling back. This may allow the threat actor to remotely access the machine.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-08-browser-run
Reasons (based on the campaign):
- backdoor
- dependency-confusion
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://18[.]144[.]73[.]108:3000/add-sshkey other packages →
IP addresses
- 18[.]144[.]73[.]108 other packages →