If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (b89b6a94f589218276e6dabe5accf4a6d6a9b22cd7412cce0a58069bccd76bbb)
The package is intended to create a backdoor and steal sensitive data, but the analyzed code did not finally exfiltrate the content of sensitive files.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-openclaw-agent
Reasons (based on the campaign):
- exfiltration-generic
- impersonation
- persistence
- peristence-autorun
- backdoor
- crypto-related
- The package overrides the install command in setup.py to execute malicious code during installation.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://91[.]92[.]242[.]30/steal other packages →
IP addresses
- 91[.]92[.]242[.]30 other packages →