If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (d52af876a91a6ff5ff8144b705201fd465db94ad89f0e1b37bd22fe6ca0f5622)
During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage executable. This is likely selectively delivered to victims as the code polls the C2 server periodically with the local hostname and awaits the next stage to download.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-pathjoin
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- brainwavehub[.]org other packages →
- gifpngstore[.]com other packages →
URLs
- hxxps://gifpngstore[.]com/test/dataP[.]php other packages →