If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)
The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/__call__) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.
Source: kam193 (07074e88a963713e68aac58354c373b9ef70d3de19b85d0c1f4a36e043b076da)
Package hides a code downloading and installing an infostealer.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-chromacli
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- action-hidden-in-lib-usage
- malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://cdn[.]discordapp[.]com/attachments/1560347732839891076/1562446203021566032/bedwars[.]exe?ex=6af1172b&is=6aefc5ab&hm=544b5aacd95a3a0cba1db54a7e7adba093e4b68b8e37c9ec7af805e8fc5e960b& other packages →
- hxxps://store-eu-par-12[.]gofile[.]io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace[.]exe other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1442967767853563904/1568964741068759060/AVKiller[.]exe?ex=6af1bbc8&is=6af06a48&hm=671b2fd3d75241e0ced0dc4db4754d89a4aa1d655a0beb20e1239c1753e0818a& other packages →
- hxxps://cdn[.]discordapp[.]com/attachments/1442967767853563904/1568948904123310080/loader[.]exe?ex=6af1ad08&is=6af05b88&hm=ebda0a26ebbbc76c3178b0a2eb0c4678c9b2deafc0d68a016a729b1331ed0fc7& other packages →