If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (a5ab85a46a37da928774b1885049b71d40d675c54683b13711f4e371d932394a)
Clone of a legitimate package with an added RAT running through a Telegram bot. It can e.g. exfiltrate env variables and execute remote commands. The malicious action does not start if the geolocation or timezone suggests a Russian area.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-parsimonius
Reasons (based on the campaign):
- typosquatting
- exfiltration-env-variables
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- rat
- clones-real-package
- abuses-pth
- geo-restricted
- uses-telegram-bot