supercolor-tui

Source: amazon-inspector (9505cdfb58ccf88da6eb5f64f02c194dbfbf1f149f1bde76118d8cab52a6760b)
The package advertises itself as a terminal color helper, but every documented call into the Color API (Color.paint, Color.print, Color.__call__, e.g. colors.red.print(...)) invokes an internal _run_payload() routine. On Windows this routine attempts UAC elevation, disables Microsoft Defender via PowerShell (Set-MpPreference -DisableRealtimeMonitoring, Stop-Service WinDefend/WdNisSvc/Sense/SecurityHealthService, Add-MpPreference -ExclusionPath pointing at the staging folder) and writes Defender-disabling registry policies (DisableAntiSpyware), then downloads an opaque executable from a Discord CDN URL (cdn.discordapp.com/attachments/.../bedwars.exe) to %TEMP%\SolaceRuntime\bedwars.exe and spawns it detached. The attacker-controlled host is a mutable third-party CDN, the payload is unverified, and the dropper is wired into the library's normal, README-documented entry points so any downstream Windows user of the library executes it. The color-helper framing is a cover story: a TUI color library has no legitimate need to disable AV or fetch and execute Windows binaries.

Source: kam193 (9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b)
Package hides a code downloading and installing an infostealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-chromacli

Reasons (based on the campaign):

- Downloads and executes a remote executable.

- malware

- infostealer

- action-hidden-in-lib-usage