If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3)
During import, package exfiltrates all files from "/sdcard/"
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-socks5901
Reasons (based on the campaign):
- files-exfiltration
- uses-telegram-bot
- target:android