If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a198ee5e2df9c67dcbd24ed19a8fec5d462bbb3c0eb474cf00cd299e75074ef5)
It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage.
As a context, it appears to be created to lure users seeking for help with the bitconinlib package: https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-bitcoinlibdbfix
Reasons (based on the campaign):
- files-exfiltration
- crypto-related
- action-hidden-in-lib-usage
- exfiltration-crypto
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://5fde88fde64f4682c2fc1e10e6c[.]vercel[.]app/api/send other packages →
- hxxps://discord[.]com/api/webhooks/1329712636807610379/eU6AZ5oBM_12FIkwvtiasyjywx7WYW7wzuWJwWU3u2kadKko7QKpXcl3Kd0fJspPhM4w other packages →