If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (8e4a4682ad923d5e0f2e444487e5f42a4bae8d753ecd747f7b652e407f5cc32f)
Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-12-reqesst
Reasons (based on the campaign):
- infostealer
- peristence-autorun
- typosquatting
- exfiltration-generic
- Downloads and executes a remote executable.
- clones-real-package
- dependency-confusion
- exfiltration-browser-data
- exfiltration-crypto
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://www[.]dropbox[.]com/scl/fi/d4ftoxxvovr12f4tjh0mc/H7Glqp2Vy[.]exe?rlkey=z323u7r1ipm2tegn2dqlqzv9l&st=9gg48qpa&dl=1 other packages →