If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (8e414a858711540d25b63ced50114d396e150157b65a70056beccc38948a4199)
The package clones a legitimate library and contains hidden code that executes remote scripts. During the analysis, the remote code was no longer available
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-fastapi-requests
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- clones-real-package
- typosquatting
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- cleverstack-ext30341[.]vercel[.]app other packages →