If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5628eb1d01e8eb7de8a582cd9ea85dff68eafde06f4e1164ae92842354db0bf7)
During building the package, it executes encrypted code. The content is unclear as the decryption key bases on the local environment variable. Given leaving a "flag" file at the end, this package can also be part of a CTF-like exercise, but it's not possible to be sure given the encrypted payload.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-leavemealone
Reasons (based on the campaign):
- obfuscation