If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (e129e6d6d38e21a039bd2190e3138f1381ad386e45a49521621a8b8ad61f7678)
The package is capable of installing malware from a hardcoded URL. The malware is well-recognized and acts as infostealer. Interestingly, it uses Steam profiles to get the current C2 domain (based on sandbox analysis).
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-logax
Reasons (based on the campaign):
- infostealer
- malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- acerputas[.]90shipsnormal[.]site other packages →
URLs
- hxxps://anonfile[.]io/api/download/rzOy11HD other packages →
- hxxps://anonfile[.]io/api/download/iJbMXihN other packages →
- hxxps://store4[.]gofile[.]io/download/web/dcec487f-df79-4ec0-99d1-ac2cc299329a/Saucy[.]exe other packages →
- hxxps://steamcommunity[.]com/profiles/76561199830115115/ other packages →
- hxxps://acerputas[.]90shipsnormal[.]site/api/log other packages →