If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (e871336d0effe99cb62efeda3a287186e75c1bd4ca5770efd81718db8ababe4e)
Malicious copy of a standard library module that during class initialization downloads and executes remote code and after that attempts to cover its tracks by overwriting itself with non-malicious code. The remote code aims to collect and exfiltrate sensitive Telegram session files.
This campaign shares infrastructure and basic methods with previous 2025-11-uzip campaign.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-12-smtblib
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- infostealer
- target:telegram
- exfiltration-credentials
- action-hidden-in-lib-usage
- covering-tracks
- clones-real-package
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://87[.]120[.]107[.]132:3301/reactor other packages →
- hxxp://87[.]120[.]107[.]132:1488/drill other packages →
- hxxp://87[.]120[.]107[.]132:1488/drip other packages →
- hxxp://87[.]120[.]107[.]132:1488/key other packages →
IP addresses
- 87[.]120[.]107[.]132 other packages →