If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a636a791b9731fe5018309c2e7890934873ab4c091520d933029f170a1848592)
Package exfiltrates content of .env files to a remote target
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-08-import-license-checker
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- us-central1-zawya-83b19[.]cloudfunctions[.]net other packages →
URLs
- hxxps://us-central1-zawya-83b19[.]cloudfunctions[.]net/submit other packages →