If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (c3e38f4b70af5228dbb3bc058a3a413daa01d50884e42e8e70b68454163118ba)
During installation, code exfiltrates environment variables and sensitive keys from .env files
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-ccxt-telemetry
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- exfiltration-env-variables
- exfiltration-credentials
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
IP addresses
- 144[.]31[.]203[.]113 other packages →