{"schema_version":"1.9.2","id":"MAL-2026-18778","published":"2026-11-09T08:18:27Z","modified":"2026-11-12T03:45:03.283944514Z","summary":"Malicious code in logger-libs (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b)\nThe package publishes under a name resembling the legitimate `log-utils`/`logger_util` library (README imports `logger_util.helper`, setup.py url points at `github.com/wolf1986/logger_libss` with a doubled-s typo). On `from logger_libs.helper import LogHelper` — the import pattern the README instructs users to perform — the `LogHelper` class body reconstructs a Python source string by concatenating `COLOR_INDEX`/`ALT_CODE` fragments scattered across `logger_libs/themes/theme_000.py` through `theme_099.py` and files under `logger_libs/ansi/`, in a shuffled `ORDER`, then base64-decodes and XORs the result with the keys `palette-build-2024` and `ansi-const-7f3a`. The decoded source is passed to a chr-code-aliased `exec` (`_BUILTIN_EXEC = getattr(builtins, chr(101)+chr(120)+chr(101)+chr(99))` in `logger_libs/_compat.py`), with `requests`, `subprocess`, `ctypes`, and related modules preloaded into the exec namespace. Immediately before invoking exec, `logging_color_set` monkey-patches `subprocess.Popen`, `subprocess.run`, `subprocess.call`, and `subprocess.check_output` so any invocation shaped `[python, '-c', <script>,...]` is rewritten to `[python, '-',...]` with `<script>` piped through stdin, concealing the executed script from argv-based process telemetry; the originals are restored in a `finally` block after the payload returns. The payload fragmentation across 114 files, the XOR+base64+chr-code encoding of both the data and the `exec` reference, and the dedicated argv-hiding subprocess shim are coherent only as a dropper/stager that runs attacker-controlled Python code on the installer's host at import of the module the README directs users to import.\n\n## Source: kam193 (b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55)\nIn this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-11-spellcheckers\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n","affected":[{"package":{"name":"logger-libs","ecosystem":"PyPI","purl":"pkg:pypi/logger-libs"},"versions":["0.4.1","0.4.2","0.4.3","0.4.5","0.4.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["logger_libs-0.4.6.tar.gz"],"path":"logger_libs/helper.py","sha256":"2b339d043f65bc1e375474cd8aeae689b6735a2d6f1915ec931d855c971ff0e0","tlsh":"4912630aad4bf44282b7941e5805f81beb9912536669a5137ebcd2a03f32954c0f1fad"},{"artifacts":["logger_libs-0.4.6.tar.gz"],"path":"setup.py","sha256":"6b754115bdc5fe30a6469292557d38480991fbcf567772badb4c059d732050bf","tlsh":"38119c570fcf236a35b5114a442a8d05e424cba72d40a4e7bafd634c6ff2b92557207c"}],"package_integrity":[{"filename":"logger_libs-0.4.6.tar.gz","hashes":{"blake2b_256":"5ed43dbb221d866b075ca339bc2807aef772950cc002a28f644628a33102a775","md5":"9d82cc98c7946cc8411eece401e78d9b","sha256":"bcc55c501c48143ca3ff0dc185cee60a93585fef6e13b9093f21490d0e33686f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/logger-libs/MAL-2026-18778.json"}}],"references":[{"type":"WEB","url":"https://helixguard.ai/blog/malicious-spellcheckers-2025-11-19"},{"type":"WEB","url":"https://www.aikido.dev/blog/malicious-pypi-packages-spellcheckpy-and-spellcheckerpy-deliver-python-rat"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/logger-libs"},{"type":"PACKAGE","url":"https://pypi.org/project/logger-libs/0.4.6/"},{"type":"PACKAGE","url":"https://pypi.org/project/logger-libs/0.4.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/logger-libs/0.4.3/"},{"type":"PACKAGE","url":"https://pypi.org/project/logger-libs/0.4.2/"},{"type":"PACKAGE","url":"https://pypi.org/project/logger-libs/0.4.5/"}],"database_specific":{"iocs":{"domains":["dothebest.store","searchbox.info","updatenet.work","kmizar.com"],"urls":["https://dothebest.store/allow/inform.php","https://dothebest.store/refresh.php","https://searchbox.info/prefer.php","https://updatenet.work/settings/history.php","https://dothebest.store/allow","https://dothebest.store/k/bag.php","https://dothebest.store/microsoft/helper.php","https://kmizar.com/prefer.php"]},"malicious-packages-origins":[{"id":"pypi/2025-11-spellcheckers/logger-libs","import_time":"2026-11-09T09:17:52.490108577Z","modified_time":"2026-11-09T08:18:27.126076Z","sha256":"b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55","source":"kam193","versions":["0.4.1","0.4.2","0.4.3","0.4.5","0.4.6"]},{"id":"IN-MAL-2026-022587","import_time":"2026-11-11T21:05:22.003018712Z","modified_time":"2026-11-11T20:49:36Z","sha256":"ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b","source":"amazon-inspector","versions":["0.4.6"]},{"id":"IN-MAL-2026-022635","import_time":"2026-11-12T03:36:56.472309768Z","modified_time":"2026-11-12T03:35:10Z","sha256":"5298529aa92672f1c6c550465615730e367f30890b1823632616f2e358d3f56e","source":"amazon-inspector","versions":["0.4.1"]},{"id":"IN-MAL-2026-022633","import_time":"2026-11-12T03:36:56.396730139Z","modified_time":"2026-11-12T03:34:56Z","sha256":"b1f9a82f259e7f5d93cd5a5ad34c3c7f21ede1eb1b7d2734e08a91ea645cb0fb","source":"amazon-inspector","versions":["0.4.3"]},{"id":"IN-MAL-2026-022634","import_time":"2026-11-12T03:36:56.44100729Z","modified_time":"2026-11-12T03:35:03Z","sha256":"366335a9d3428c5a737b426e8db37d2773dd9b27c639b839ca0ab4c642b0e559","source":"amazon-inspector","versions":["0.4.2"]},{"id":"IN-MAL-2026-022632","import_time":"2026-11-12T03:36:56.370945863Z","modified_time":"2026-11-12T03:34:50Z","sha256":"4e4a0dc5159ce15e4cc5ec2c71a909bccea8eb2c8bc774f14a5adeb053247a3c","source":"amazon-inspector","versions":["0.4.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}