If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (f0221b6839d8882a9275e177ae71c7bed9cc15a96800e4cead5766c67f0dd042)
Installation embeds a malicious PTH file that then during import downloads and executes remote code. During analysis, the remote code was a test starting calculator, but the owner can changd it anytime.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-robloxapi-testy
Reasons (based on the campaign):
- clones-real-package
- Downloads and executes a remote malicious script.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://github[.]com/vdreamer/valeslovelypoc/raw/refs/heads/main/ee[.]py other packages →