If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (aed54ed734902c1a5749b7861e2ad95cc2d8c71c78fa4b0167499f9a1b296f9f)
Importing the module downloads and starts an infostealer.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-db-aggregator-api
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://www[.]dropbox[.]com/scl/fi/9guh7pdcap45paceyvu9q/updater[.]exe?rlkey=3zukihnlct2qsz7c3ds05isd0&st=ra8iyhmt&dl=1 other packages →