If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (7fe681cdeb2892cd4e567b4ac8aeb6e0eb22885cce024238e010af54711831ec)
Highly obfuscated code that during import downloads a remote script with another obfuscated code. The repository with remote script also contains clearly infostealer code
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-textgradient
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://raw[.]githubusercontent[.]com/imsoprime/w/refs/heads/main/server[.]py other packages →
- hxxps://raw[.]githubusercontent[.]com/imsoprime/w/refs/heads/main/server2[.]py other packages →
- hxxps://github[.]com/imsoprime/w/ other packages →
- hxxps://t[.]me/sliverbulletpro2 other packages →