If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401)
On `import dev_helper`, the package's __init__.py starts a daemon thread that runs decryptor.decrypt_and_run(): it fetches an AES-GCM key from the hardcoded endpoint https://key-2qfm.vercel.app/api/key, decrypts the shipped dev_helper/encrypted.bin (16.9 KB ciphertext, nonce prepended), and executes the plaintext via exec(plaintext, {'__name__': '__main__'}). The auto-start is gated to skip interactive Python sessions and PYTHONSTARTUP contexts, so the payload fires in CI and production imports but stays hidden from REPL inspection. Logging is disabled (logging.disable(logging.CRITICAL)) and errors are swallowed. The package's stated purpose ("a helpful developer utility") does not disclose any of this, and the true payload is opaque without the remote key, allowing the operator of key-2qfm.vercel.app to rotate the executed code at will.
Source: kam193 (39bf40d5056dc821bcedf5fcc304e26d9e6566f5beb508b6a01874b49d32becd)
The package embeds encrypted code that, during import, is decrypted using an externally sourced password. The recovered code is executed and starts a bot capable of exfiltrating local files.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-make-helper
Reasons (based on the campaign):
- files-exfiltration
- obfuscation
- uses-telegram-bot
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- key-2qfm[.]vercel[.]app other packages →
URLs
- hxxps://key-2qfm[.]vercel[.]app/api/key other packages →