If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (9f558ab07d5858b728bc43a5a17c5eff73b0413f2d871ac3bc33b1b8c30a6ef5)
During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-08-raknet-testing-package
Reasons (based on the campaign):
- exfiltration-generic
- modify-system-without-consent
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://www[.]dropbox[.]com/scl/fi/6pwocr2yfcaqztfoxkwqm/mitmproxy-ca-cert[.]pem?rlkey=irl7718in0yr3pwnhgftcm0sm&st=fnll7kc5&dl=1 other packages →
- hxxps://pastebin[.]com/raw/hEF5HaFc other packages →
IP addresses
- 196[.]251[.]86[.]48 other packages →