paperclip-ai

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793)
No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No lifecycle hooks or suspicious build-backend activity were observed.

## Source: kam193 (643de4cab1ea2f7becbca5a7dead46fcb39f35596d2bf7a371fdd2c82ded1530)
A clone of a legitimate package with added code that exfiltrates env variables and multiple sensitive files: credentials, dotenv, shell history, etc. Exfiltrated credentials were quickly validated by the attacker.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-browser-use-headless


Reasons (based on the campaign):


 - files-exfiltration


 - exfiltration-env-variables


 - exfiltration-credentials


 - clones-real-package

Compromised versions (2)

• 0.1.0
• 0.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.