If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: google-open-source-security (5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5)
This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
The package will steal credentials and then propogate it to every package it has access to. The package also attempts to remain persistent.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- git-tanstack[.]com other packages →
- filev2[.]getsession[.]org other packages →
- api[.]masscan[.]cloud other packages →
- seed1[.]getsession[.]org other packages →