If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (8b847ab6789b3a3848d887f76adae74d05523dd4cb1a974372518679d27ed70e)
The package masquerades as a utility, but during import, code loads obfuscated modules with RAT- and spyware-like functionality, including: exfiltrating files, executing remote code, taking screenshots, monitoring and exfiltrating the clipboard content. Malicious code is controlled via Discord.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-aiolrucache
Reasons (based on the campaign):
- rat
- spyware-like
- keylogger
- clipboard-stealing
- obfuscation
- files-exfiltration