If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554)
This one package is clearly created as part of the campaign, but the malicious code from the previous version has been removed (no other changes). It is anyway dangerous as most probably will be updated with the malicious code later
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-08-aws-enumerate
Reasons (based on the campaign):
- exfiltration-generic
- action-hidden-in-lib-usage
- exfiltration-credentials
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- api[.]aliyun-sdk-requests[.]xyz other packages →
- aliyun-sdk-requests[.]xyz other packages →
URLs
- hxxps://api[.]aliyun-sdk-requests[.]xyz/aws other packages →
- hxxps://github[.]com/kohlersbtuh15/accesskey_tools other packages →