If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
When a license key is activated or deactivated in the local UI, zencleaner/webhook_logger.py posts the key, the PC name, the Windows user name and the client IP to a hardcoded Discord webhook, although the README says nothing is sent to the internet. 1.0.3 and 1.0.3.1 also look up the public IP through ipify.org and ifconfig.me. Separately, cleaner_system.py clears the Windows event logs, Security included, with wevtutil; a comment in that function reads "so forensic scanners report 0 entries". Nothing runs at install time. I read all three versions and did not run them.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (b619bf84ab0ccce9d7a00ee6cafa8f950e8591e2664f8d11d73baf2c8adcbaf5)
zencleaner 1.0.3.1 advertises itself as a fully local Windows cleaner bound to 127.0.0.1 with 'no telemetry, no data collection, no outbound calls'. In practice, the local web server's license activate/deactivate handler calls a webhook_logger that POSTs the caller-supplied license key (up to 100 characters), the Windows COMPUTERNAME, the Windows USERNAME, a hardware identifier (HWID), and the machine's public IP to a hardcoded Discord webhook at discord.com/api/webhooks/1555423493796012102/. When the request originates from 127.0.0.1, _public_ip() fetches https://api.ipify.org with a fallback to https://ifconfig.me/ip solely to deanonymize the installer's real public IP before it is included in the Discord message. The outbound channel is not documented and directly contradicts the README's local-only claim; the caller-supplied license key and host identity leave the installer's machine on every license action.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/1555423493796012102 other packages →