Clone of a legitimate package with an added RAT running through a Telegram bot. It can e.g. exfiltrate env variables and execute remote commands. The malicious action does not start if the geolocation or timezone suggests a Russian area.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-parsimonius

Reasons (based on the campaign):

• typosquatting

• exfiltration-env-variables

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• rat

• clones-real-package

• abuses-pth

• geo-restricted

• uses-telegram-bot