If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5a7814d65bb3b0e5187be5d4ae9b0a11b4030ea5d911fdef3f5e614b6c15e95d)
Installation embeds a malicious PTH file that then during import downloads and executes remote code. During analysis, the remote code was a test starting calculator, but the owner can changd it anytime.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-robloxapi-testy
Reasons (based on the campaign):
- clones-real-package
- Downloads and executes a remote malicious script.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://github[.]com/vdreamer/valeslovelypoc/raw/refs/heads/main/ee[.]py other packages →