If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (f2eb5eb75679b536c430ad6d5440e63fbe1d1cd391ab1abf2a411dae3a768ed8)
There is a hidden code that overwrites the default method and downloads remote data, which contains the dictionary pretending to be the right value, and a hidden code to exfiltrate machine ID and download and run a remote code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-ccxt-mexc-futures
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- update[.]mexc[.]workers[.]dev other packages →
- v3[.]mexc[.]workers[.]dev other packages →
- mexc[.]workers[.]dev other packages →
URLs
- hxxps://v3[.]mexc[.]workers[.]dev/describe[.]json other packages →
- hxxps://update[.]mexc[.]workers[.]dev/ other packages →