If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d43e83ac1c0257aa1168edf9c20430524b46520f60a5f5a0c0e1c2040afa0c87)
Under a typosquatting name there is a package prepared to exfiltrate photos from a phone, although it requires external trigger.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-12-requetses
Reasons (based on the campaign):
- typosquatting
- files-exfiltration