If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (8a78aff2389300306864bb3d44e1ac70675e128845a4d734dae5ffbc39076b93)
Clone of a legit Telegram client, with a hidden code that, under some conditions, can attempt to destroy the Linux OS.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-heroku-tl
Reasons (based on the campaign):
- clones-real-package
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- banlist[.]heroku-ub[.]top other packages →
- heroku-ub[.]top other packages →
URLs
- hxxps://banlist[.]heroku-ub[.]top/get_ids other packages →