If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (ff748393cb55e78c43fea879bbd55034152148246aa8d45359cfa8517845e17c)
Importing the module starts an Infostealer
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-hyperreq
Reasons (based on the campaign):
- infostealer
- obfuscation
- files-exfiltration
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- webhook[.]lewisakura[.]moe other packages →
URLs
- hxxps://webhook[.]lewisakura[.]moe/api/webhooks/1060926349793050725/11cIlB9OtDMuZbxqAHDnST4LuzQkR9CzTsFuCYJMCYnns028ZyPvupSs76pYktLfqpij other packages →
- hxxps://discord[.]com/api/webhooks/1063474064779386930/XoGeQXfBC2uTbBafVTuUDn3oGz5hXYDwSxRhxy4Tk1fkvyba611Fnm_Ozfw-5RptAgDl other packages →