If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a8fa27c8dc6bf13a4f5d92f14414a4f5efc08c1df7f33591a010b4f824e84bc1)
During import package exfiltrates the environment variables and cloud credentials/tokens to a hardcoded location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-04-sf-th-requests
Reasons (based on the campaign):
- exfiltration-env-variables
- exfiltration-cloud-tokens
- exfiltration-credentials
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://100[.]31[.]118[.]36:80/beacon other packages →
- hxxp://35[.]170[.]72[.]247:80/beacon other packages →
IP addresses
- 100[.]31[.]118[.]36 other packages →
- 35[.]170[.]72[.]247 other packages →