If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (85e8a68bad6595a817f1dabed757662e2a04cfec7b45a86d9bfd61a7a78d14d1)
During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating crypto wallets and browsers data. Likely continuation of 2026-05-py-requests
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-06-alembic-util
Reasons (based on the campaign):
- infostealer
- The package overrides the install command in setup.py to execute malicious code during installation.
- crypto-related
- Downloads and executes a remote malicious script.
- exfiltration-browser-data
- exfiltration-crypto
- persistence
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]github[.]com/repos/guellemilb/c2-relay/issues/1/comments other packages →
- hxxps://gist[.]githubusercontent[.]com/guellemilb/631fb6348967d9d475125edf67048c0e/raw/build_utils[.]py/raw/pyrat_light[.]py other packages →
- hxxps://gist[.]githubusercontent[.]com/guellemilb/631fb6348967d9d475125edf67048c0e/raw/build_utils[.]py other packages →