If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (aa2920b4ae77a6e47bbf9ac8163f8d9a30d62966097d34989a36103a76178558)
Importing the module starts an infostealer
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-mescouilles
Reasons (based on the campaign):
- infostealer
- infostealer:kiwi
- infostealer:cstealer
- exfiltration-generic
- exfiltration-browser-data
- exfiltration-credentials
- files-exfiltration
- The package contains code to detect if it is running in a sandbox environment.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- honey[.]zakura-int[.]workers[.]dev other packages →
URLs
- hxxps://discord[.]com/api/webhooks/1438590458204000289/GoNmnNIWqcL152FVm8uszof971e2NnyNjsO4j_o4ZJuP9AhMaaR5XBEkkYcKP1GBcouo other packages →
- hxxps://discord[.]com/api/webhooks/1113937838837346429/iG7DEPvhfOdswri8SyWslR4bZY-XV-kOyQlwrUt_yOOMowuExGYAPnnHEO60XTfYt6VJ other packages →
- hxxps://pastebin[.]com/raw/vb608t9D other packages →