If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (ccc67c8452789facd5ba7b991c89a1410dc3058f1c8112c16812e8d004efdf0f)
Package attempts to exfiltrate various credential files. In the analyzed version, the exfiltration target was set as localhost suggesting it's not the final code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-gauth-client
Reasons (based on the campaign):
- exfiltration-credentials
- impersonation
- files-exfiltration