If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (dfe85cdb01cd65f379803d150e3cd9142774bda4f802120401655f71b5b7a907)
During installation and importing the module, the package silently downloads malware
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-01-coolpackage2323
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- malware
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://files[.]catbox[.]moe/xizzpo[.]png other packages →