If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (13b29a753802db633ab987963543535999a246049761d4d29699b66edf207f13)
During import, package masquerade and starts an embedded executable. The executable has signs of infostealer activity
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-requests-toolkit
Reasons (based on the campaign):
- impersonation
- infostealer
- malware
- The package contains code to detect if it is running in a sandbox environment.
- keylogger