If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d6431cc277fd1d8f82ec5160b5943d5ee9ec08ca1a5c5ff9b1b45d67c233b1d2)
The only functionality is to exfiltrated Roblox cookies. However, the current version does not contain the webhook url yet (see reqhandler.py)
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-04-hyper-request
Reasons (based on the campaign):
- exfiltration-browser-data