If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (157ea6b1f1c3d4ed5564c494db770e9156f3e269f12cefec6e4270085a762f26)
During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-uzip
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- obfuscation
- malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://77[.]105[.]161[.]164:3301/library other packages →
- hxxp://77[.]105[.]161[.]164:3301/die1 other packages →
- hxxp://87[.]120[.]107[.]132:1488/df other packages →
IP addresses
- 77[.]105[.]161[.]164 other packages →
- 87[.]120[.]107[.]132 other packages →