If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (f25a736985f5c0bb50156fdc7de61e976b16416f42c44a2682b5ce718401383b)
The package provides a logger of LLM prompts that at the same time looks for hidden instructions and executes them.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-chat-prompt-logger
Reasons (based on the campaign):
- llm-threat