If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (10bfd6e986187675dd7d7e3a8f860807e408fd6a91694ca0e0128be83fa8fc47)
Importing the module exfiltrates content of /var/www/html to a remote host
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-12-system-health-check-test-unique
Reasons (based on the campaign):
- files-exfiltration
- obfuscation
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- dool[.]cloudyhost[.]org other packages →
- cloudyhost[.]org other packages →
URLs
- hxxp://dool[.]cloudyhost[.]org/up[.]php other packages →
IP addresses
- 185[.]208[.]172[.]174 other packages →