---

-= Per source details. Do not edit below this line.=-

Source: kam193 (7cd1ebfd030a45f91ca541aaec69795656342b54ccd092eecb7117adb89e7f63)

During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials