---

-= Per source details. Do not edit below this line.=-

Source: kam193 (f1b5dafc5b04761cd45c3c22cb68a171eaf1cf6431189c8fecb1249c3443e042)

During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials