If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (c88fa4e30e2437fef5f03db434adb0f34ee48d8bec2d3361d123b10086b28772)
Clone of a legitimate library with added malicious code that runs during generating a new mnemonic. The malicious code collects data related to cryptocurrency wallets and selected other files, and exfiltrate them to a hardcoded location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-mnemoniclib
Reasons (based on the campaign):
- clones-real-package
- action-hidden-in-lib-usage
- crypto-related
- exfiltration-crypto
- files-exfiltration
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://65[.]21[.]205[.]84:5000/upload other packages →
IP addresses
- 65[.]21[.]205[.]84 other packages →