If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (27014d3a14c4b1df61609aa62f901b3f8cb01f4898bb729d52d6cd08928555be)
If the method "SetTerminalColor", imitating colorama package, is called, then the code exfiltrated browser, discord and Minecraft passwords/tokens.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-04-colorona
Reasons (based on the campaign):
- action-hidden-in-lib-usage
- typosquatting
- exfiltration-browser-data