If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-10 seconds: an Ethereum smart contract used as a dead drop (Arbitrum Sepolia) and a Slack bot token.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- gocommunity[.]io other packages →
- gogets[.]dev other packages →
- portfolio-devs[.]slack[.]com other packages →
- portfolio-testers[.]slack[.]com other packages →
- mediumstar[.]slack[.]com other packages →