---

-= Per source details. Do not edit below this line.=-

Source: kam193 (c292f1166524fea3daf3009405cb97a331812cd50074ee39254485514d0639fc)

During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials