If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5d3d6ca7ec9867abcf3fb8a0170ca44801107a64fb1ff7f9aa437dd7b1f59845)
During installation, package downloads downloads and executes next-stage script that then downloads a Sliver beacon and establishes persistence via a systemd service
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-httpx-utils
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- persistence
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- redir[.]acysec[.]site other packages →
- acysec[.]site other packages →
URLs
- hxxps://redir[.]acysec[.]site/scripts/update[.]sh other packages →
- hxxps://api[.]github[.]com/repos/YoungKevinn/system-updater/releases/assets/409658341 other packages →
- hxxps://gist[.]githubusercontent[.]com/YoungKevinn/96af9afbde472731f39a8a457b3e13db/raw/e9226aecb69eca0871b207a24d0b2ccaac4e2d13/update-manifest[.]txt other packages →