If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (69baeb910fc47c2e92e2a25cb1db7b5148b4773d193f15aecef4d708f69b1f6d)
The package clones a legitimate library and contains hidden code that executes remote scripts. During the analysis, the remote code was no longer available
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-fastapi-requests
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- clones-real-package
- typosquatting
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- cleverstack-ext30341[.]vercel[.]app other packages →