If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f0a52dbba9abeff2c606bcbc862027da259fcbd3938c827abfdbdb06ba801ecb)
setup.py overrides the install and egg_info commands with a RunCommand() class that fires unconditionally on `pip install` or `pip download`. The override reads the entire process environment via `os.environ`, serializes every key=value pair, captures the output of `ps -elf`, and POSTs the combined payload over plaintext HTTP via curl to a hardcoded interactsh/OAST subdomain (gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun). On developer machines and CI runners, the captured environment routinely contains AWS_SECRET_ACCESS_KEY, GH_TOKEN, NPM_TOKEN, PYPI_TOKEN, and similar credentials, all of which are leaked to an arbitrary attacker-controlled callback host. The package name is suggestive of a `dotenv` typosquat and the README self-identifies as a proof-of-concept; a comment claims the code is 'for research not for doing any harmful activity', but the cover story does not change the fact that any installer is subjected to live credential theft.
Source: kam193 (6d0048d35301edad3a673cfd44c244a805586b25d3027758738aa8939099f1cc)
During installation, the package exfiltrates env variables
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-ip-rotat
Reasons (based on the campaign):
- The package overrides the install command in setup.py to execute malicious code during installation.
- exfiltration-env-variables
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- gjampdwmdjmppwedtkpbbdkq05f6iiz6r[.]oast[.]fun other packages →