If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (f2cfd59dcec981250aeaf0633059cfd0af4d5dac6c87a1d54b9e13ce70957858)
Designed to run on Android. Under the mask of an AI agent, the code downloads a remote executable on import, and during usage, silently exfiltrates data like text messages and contacts.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-metoopro
Reasons (based on the campaign):
- infostealer
- files-exfiltration
- exfiltration-generic
- Downloads and executes a remote executable.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://raw[.]githubusercontent[.]com/Sufiyan65889/Rish-Shizuku/main/rish_shizuku[.]dex other packages →
- hxxps://raw[.]githubusercontent[.]com/Sufiyan65889/Rish-Shizuku/main/rish other packages →
- hxxps://github[.]com/Sufiyan65889/HAck-Pypi[.]git other packages →