If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (89ed03d9e80d4ef62c54087a12177f795e478b1b5e5a8af69ef4e4740e102186)
If run as module, it attempts to automatically destroy user's and system's files. Some versions also exfiltrate them.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-07-hahabott
Reasons (based on the campaign):
- files-exfiltration
- destructive-actions