If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5a2f90c0e3c6e46456cd3e319aaaf4a7b53475a554a997a964fdda898e85fcd0)
If imported, the module starts a multi-stage infostealer, exfiltrating browser data as well as crypto wallets, and also attempts to monitor clipboard looking for crypto wallets addresses
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-05-fernets
Reasons (based on the campaign):
- infostealer
- clipboard-stealing
- exfiltration-generic
- obfuscation
- exfiltration-browser-data
- exfiltration-crypto
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://196[.]251[.]81[.]229:6969/1[.]txt other packages →
- hxxp://196[.]251[.]81[.]229:6969/download/svchost[.]bat other packages →
- hxxp://196[.]251[.]81[.]229:6969/clippa[.]txt other packages →
- hxxp://196[.]251[.]81[.]229:6969/2[.]txt other packages →
- hxxp://196[.]251[.]81[.]229:8000/repeter/viiZ8YGt0HnubnyN other packages →
IP addresses
- 196[.]251[.]81[.]229 other packages →