If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (72561775d8d7a7c1e47c83f2a7e13ed9eeb776d05ca6924cfcceaca7cad0cfef)
Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a generic entry point triggering malicious action.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-pipipipi
Reasons (based on the campaign):
- clones-real-package
- rat
- Downloads and executes a remote malicious script.
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://tinyurl[.]com/47h5bmcw other packages →
- hxxps://www[.]dropbox[.]com/scl/fi/ybqsqvbquwbk9h59aottq/shadowsocksvpn[.]ps1?rlkey=2huygpgfs1pmasr9h70tr9zti&st=1ghv9gld&dl=1 other packages →