If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (ccf88804317b4caf9661eb94c320a521f7689c5cf26a8754ec219d268fc9c873)
During import, package masquerade and starts an embedded executable. The executable has signs of infostealer activity
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-requests-toolkit
Reasons (based on the campaign):
- impersonation
- infostealer
- malware
- The package contains code to detect if it is running in a sandbox environment.
- keylogger