If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (2c45f904631a26aae94cafeeac5ea0f7efe0fc5d4f46dea48da17dcb766111d5)
The package, with an innocent looking name, has as the only functionality reporting to a Telegram channel given username and password. The functionality is in the "HeadersUpdate" class, that also looks like attempting to look innocent. The code does nothing more than reporting given credentials through a bot using the name "hitlercute_bot".
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-02-updateuuid4
Reasons (based on the campaign):
- infostealer