If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a7a4369b02deb0d2a9cf1340be0efe760e29f7979e3f7361ba029a282b70597f)
Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other, correct uploading URLs
Some of related packages only test partial malicious code, like webhooks from overwritten setup.py
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-07-0x9xnx
Reasons (based on the campaign):
- infostealer
- obfuscation
- exfiltration-browser-data
- exfiltration-crypto
- The package overrides the install command in setup.py to execute malicious code during installation.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- chrome-data-receiver[.]up[.]railway[.]app other packages →
- chrome-extract[.]up[.]railway[.]app other packages →
- vell-production[.]up[.]railway[.]app other packages →
URLs
- hxxps://chrome-data-receiver[.]up[.]railway[.]app/upload other packages →
- hxxps://chrome-extract[.]up[.]railway[.]app/upload other packages →
- hxxps://vell-production[.]up[.]railway[.]app/upload other packages →