If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (c8aa87f03342830d082dcfd87dfce0528b19781902f9c9e56a7379046d8a1572)
Importing the module starts a UAC bypass through fodhelper to run a privileged shell, and download and execute a remote file.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-06-syscachelib
Reasons (based on the campaign):
- Downloads and executes a remote executable.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://pixeldrain[.]com/api/file/W9GvXEhE?download other packages →