If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (52e0861f6664f547a0cc13ab9b6aea123213946a49bbdc341e15be6ff6d53b61)
Package contains a known Blank Grabber infostealer that starts on importing the module
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-05-pydoxing
Reasons (based on the campaign):
- infostealer
- exfiltration-generic
- obfuscation
- exfiltration-browser-data
- infostealer:blankgrabber