If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (ab8c06b5d7e9b98d62708ab7377d9e18a214e884c69b0c7217979121aed06917)
When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables and selected information from credential files. The code claims to be security research.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-open-vp-cal
Reasons (based on the campaign):
- exfiltration-env-variables
- Downloads and executes a remote malicious script.
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- pack[.]nppacks[.]com other packages →
- nppacks[.]com other packages →
URLs
- hxxp://pack[.]nppacks[.]com/pip/open-vp-cal-spg-jp other packages →
- hxxp://pack[.]nppacks[.]com/kurkur[.]php other packages →