If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967)
The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed ~108 KB string literal and passes the resulting ~80 KB opaque blob directly to exec(). qoeoe/__init__.py imports starts unconditionally, so the decoded payload runs on any `import qoeoe`. The package has an empty README, no advertised functionality, no readable API surface, and no legitimate reason to hide its module body behind reversed+base64 obfuscation piped to exec. This is the import-time loader/dropper shape: arbitrary attacker-controlled code executes on the installer's Python interpreter as soon as the package is imported.
Source: kam193 (fb52479116026de0be08479d69a7e28915fc9add4b66ff31152b0a47dc256977)
The provided functionality hides code that exfiltrates files to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-asti
Reasons (based on the campaign):
- files-exfiltration
- action-hidden-in-lib-usage
- target:android