If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d91767b12efcd1ad71b86b8d6770f33ddd3f1bfdec795dc04fd1d743a63a4591)
Through an obscure way, one of the package files got overwritten by a remote obfuscated code, which appears to be an infostealer. After executing the malicious code, the package covers the tracks by overwriting all relevant code files.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-11-asn1tool
Reasons (based on the campaign):
- obfuscation
- dependency-confusion
- typosquatting
- clones-real-package
- infostealer
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://tinyurl[.]com/1atestver other packages →
- hxxps://tinyurl[.]com/l4kr0sr4t other packages →
- hxxps://tinyurl[.]com/w1ngfjs other packages →