If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (fe398aee3ca61989d1610e4b2edae183ef70d5fabc08709875ca9ef8725d82c5)
Package contains two DLL libraries, one of them packed. Both are widely recognized as malware. The exact behavior is not known
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-01-old-1q847
Reasons (based on the campaign):
- malware
- obfuscation