If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (3a4508be29963ffe0a2d8b245449cf80873bdd6037c226e94ff99d9937566c7d)
During import package exfiltrates the environment variables and cloud credentials/tokens to a hardcoded location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-sf-th-requests
Reasons (based on the campaign):
- exfiltration-credentials
- exfiltration-env-variables
- exfiltration-cloud-tokens
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://100[.]31[.]118[.]36:80/beacon other packages →
IP addresses
- 100[.]31[.]118[.]36 other packages →