If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file (btreex.sql). The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT (Ethereum smart contract dead drop plus Slack bot token) used by gocommunity.io/orderedbtree.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- gocommunity[.]io other packages →
- gogets[.]dev other packages →
- portfolio-devs[.]slack[.]com other packages →
- portfolio-testers[.]slack[.]com other packages →
- mediumstar[.]slack[.]com other packages →