If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (2ae45d504dadccaa437ebeaa729136ca7b38074149772b076c7abb34ab1e81f4)
Code exfiltrates sensitive crypto wallet's files and sets up a keylogger trying to catch the password to the wallet
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-pckg-sv
Reasons (based on the campaign):
- crypto-related
- keylogger
- exfiltration-crypto
- persistence