If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5a2ff07802c4546c40d47d3780971506115297a1e8c177be36ad1e003dd62937)
The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and some remote control possibilities like switching the computer off and grabbing clipboard content. Some content suggests it was designed to be used by the uploader themself, but it poses the risk to anyone installing it.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-sentinel-tool
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- spyware-like
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://raw[.]githubusercontent[.]com/offc559-crypto/senitel/main/Sentinel[.]exe other packages →