If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19)
Importing the `nero` package triggers `nero/__init__.py` to load `nero.main`, whose top-level code runs a `_guard()` routine before executing a hidden payload. `_guard()` performs anti-debug checks (`sys.gettrace`, `sys.settrace(None)`, `_getframe().f_trace`), timing checks, and substring matching against sandbox/VM indicators (`sandbox`, `virtualbox`, `vmware`, `qemu`, `wine`, `hyperv`, `xen`) in PATH, the Python executable path, and processor identifiers. It then base64-decodes a ~110KB blob, decrypts it with a custom RC4-like keystream cipher keyed by the string `Cxdgs`, and passes the plaintext to `exec()`. The decrypted code is opaque and only reachable on machines that pass the anti-analysis gauntlet. The combination of import-time `exec` of a custom-encrypted blob with dedicated anti-VM and anti-debug evasion is inconsistent with the package's stated 'account generator' purpose and matches the shape of hostile install/import-time code execution against the installer's host.
Source: kam193 (458a2993d1a429a687102ddfca3f9fc0c91f72373b07ccad6ff83fb56add7e58)
Obfuscated code is used to abuse systems of garena[.]com for mass account generation, bypassing their security systems.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-neroteam-v1
Reasons (based on the campaign):
- obfuscation
- abusing-3rd-api
- The package contains code to detect if it is running in a sandbox environment.