If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d4b44b0fb797b54e70ce9da891342e05380f0a6aa9ff1c8fb43a3a65e7babe97)
Importing the module downloads and executes widely recognized malware
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-08-k7eel
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://github[.]com/mtlnewacc6-sys/adadad/raw/refs/heads/main/x69[.]exe other packages →
- hxxps://github[.]com/byebyeeeeeeaaa/turbo-guide/raw/refs/heads/main/Payload[.]exe other packages →
- hxxps://github[.]com/deprosinal/legendary-funicular/raw/refs/heads/main/helo[.]exe other packages →
- hxxps://github[.]com/deprosinal/didactic-octo-funicular/raw/refs/heads/main/Payload[.]exe other packages →
- hxxps://github[.]com/deprosinal/sturdy-fiesta/raw/refs/heads/main/XClient[.]exe other packages →
- hxxps://github[.]com/deprosinal/jubilant-parakeet/raw/refs/heads/main/41222[.]exe other packages →
- hxxps://github[.]com/deprosinal/shiny-telegram/raw/refs/heads/main/XClient[.]exe other packages →