super-color

Source: amazon-inspector (9f011b9543cf75605eb55a45f8178b552c3a9371687bd9ff6112275b67290cf8)
super-color presents itself as a terminal color library but, on Windows, every advertised Color method (paint/print/__call__, e.g. colors.red.print(...), colors.green(x)) invokes an internal _run_payload() routine that fetches a Windows executable from https://cdn.discordapp.com/attachments/1442967767853563904/1568948904123310080/loader.exe with three fallbacks (urllib with a Chrome User-Agent, curl, and certutil -urlcache -split -f), writes the bytes to %TEMP%\SolaceRuntime\python315.exe after verifying the MZ header, and launches the file detached via subprocess.Popen with DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW. The staging directory and filename impersonate a Python runtime, the LOLBin fallback chain and hidden-window flags are standard Windows commodity-dropper evasion, and the fetched payload is attacker-controlled content hosted on a Discord CDN unrelated to the package's stated purpose. Normal usage of the library on Windows therefore results in an attacker-controlled PE executing on the installer's machine.

Source: kam193 (908af2bf828b75158c5bf0aae5a9d422694f21f566a745ff42b82f1f7ed4560d)
Package hides a code downloading and installing an infostealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-chromacli

Reasons (based on the campaign):

- infostealer

- Downloads and executes a remote executable.

- action-hidden-in-lib-usage

- malware