If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a56926028e7e253a1ffb3ba27d6514a5cbc6b23964d7e1094846a895dd322656)
Code exfiltrates sensitive crypto wallet's files and sets up a keylogger trying to catch the password to the wallet
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-pckg-sv
Reasons (based on the campaign):
- crypto-related
- keylogger
- exfiltration-crypto
- persistence