If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (6e089d4b8b0fe90a96024c1160f198df5ab7ec0b30f1f5765cf81ef4aa640279)
Designed to run on Android. Under the mask of an AI agent, the code downloads a remote executable on import, and during usage, silently exfiltrates data like text messages and contacts.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-metoopro
Reasons (based on the campaign):
- infostealer
- files-exfiltration
- exfiltration-generic
- Downloads and executes a remote executable.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://raw[.]githubusercontent[.]com/Sufiyan65889/Rish-Shizuku/main/rish_shizuku[.]dex other packages →
- hxxps://raw[.]githubusercontent[.]com/Sufiyan65889/Rish-Shizuku/main/rish other packages →