If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (deb22bdfdecb739735dd50a5e0e2fe8329ee260b7236db8112629d7516d081d4)
Package contains an infostealer and is clearly prepared for using it. Different versions present different variations, newer are based on CStealer. The exfiltration target is a hardcoded discord webhook
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-09-suyo
Reasons (based on the campaign):
- infostealer
- infostealer:cstealer
- exfiltration-browser-data
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/1416787330873688224/4PB-5IWwMalA9DM5aNtX2O1V1FhofPrA2HkcfBqrcPnSy-ue-s5xLi9jxaPpMAjup-5I other packages →