logger-libs

Source: amazon-inspector (ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b)
The package publishes under a name resembling the legitimate `log-utils`/`logger_util` library (README imports `logger_util.helper`, setup.py url points at `github.com/wolf1986/logger_libss` with a doubled-s typo). On `from logger_libs.helper import LogHelper` — the import pattern the README instructs users to perform — the `LogHelper` class body reconstructs a Python source string by concatenating `COLOR_INDEX`/`ALT_CODE` fragments scattered across `logger_libs/themes/theme_000.py` through `theme_099.py` and files under `logger_libs/ansi/`, in a shuffled `ORDER`, then base64-decodes and XORs the result with the keys `palette-build-2024` and `ansi-const-7f3a`. The decoded source is passed to a chr-code-aliased `exec` (`_BUILTIN_EXEC = getattr(builtins, chr(101)+chr(120)+chr(101)+chr(99))` in `logger_libs/_compat.py`), with `requests`, `subprocess`, `ctypes`, and related modules preloaded into the exec namespace. Immediately before invoking exec, `logging_color_set` monkey-patches `subprocess.Popen`, `subprocess.run`, `subprocess.call`, and `subprocess.check_output` so any invocation shaped `[python, '-c', <script>,...]` is rewritten to `[python, '-',...]` with `<script>` piped through stdin, concealing the executed script from argv-based process telemetry; the originals are restored in a `finally` block after the payload returns. The payload fragmentation across 114 files, the XOR+base64+chr-code encoding of both the data and the `exec` reference, and the dedicated argv-hiding subprocess shim are coherent only as a dropper/stager that runs attacker-controlled Python code on the installer's host at import of the module the README directs users to import.

Source: kam193 (b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55)
In this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-spellcheckers

Reasons (based on the campaign):

- obfuscation

- Downloads and executes a remote malicious script.

- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.