If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (4d5962bd4c41d59c276f1fa132030098e557dee6bfe0b0a368a952f70d217287)
The package contains an infostealer targeting the Roblox ecosystem.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-modulebuild3240234t
Reasons (based on the campaign):
- obfuscation
- infostealer
- exfiltration-credentials
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/1509322846877515958/1lhoM9D4U-eyvVefaufc9TxQbRYBeZiLSUEhnRhS2dGG4jaLXCFc5B4vjqyBGfAWtVjU other packages →