If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (0846b9b18e7af4ddef44ca9cb92d5543ace58ee3f171080b1570c3f044749dec)
Code attempts to exfiltrate any env variable containing "key" in name. This action is triggered on multiple occasions thanks to overwriting module loading and patching.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-07-gpu-free-ai
Reasons (based on the campaign):
- exfiltration-env-variables