If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (6482a67f89f2d1c1c86faa07e57079b58fc63b84013774eeced6ed752da99ba3)
The package pretends to do something meaningful, but in fact, just exfiltrates users' cookies from the browser
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-voipms-service
Reasons (based on the campaign):
- exfiltration-browser-data