If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (20f53888d08d0aa70146b50e8dc761373490363f9081ea0adb9fb93cfd2b6240)
Package implements exfiltrating credentials from cloud environments to a hardcoded location. Some code parts suggest it may be part of a CTF.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-cscc-glass-house
Reasons (based on the campaign):
- exfiltration-credentials
- exfiltration-env-variables
- exfiltration-cloud-tokens