If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (2a5f0848002e1727d885bdf20c39e4949fd9609a4df5164a8c42ccc870aa6736)
Code attempts to download and run malware, as well as keeps ability to execute files sent via Telegram C2 channel
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-07-logghelper
Reasons (based on the campaign):
- malware
- infostealer
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://89[.]23[.]97[.]112:8080/Python[.]exe other packages →