Skip to content

MALICIOUS (1) campaign cataloged at 2025-12-10(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-12-loguru-utf8

Package clones a popular package (loguru, jsonschema, ...). While it claims to have some additional features, the real change is an added compiled native library which is silently loaded in the background during the importing of the module. The exact behavior is unknown, but the binary is obfuscated

Abuse categories

clones_real_package

Campaign uses clones_real_package.

native-extension

Campaign uses native-extension.

obfuscation

Campaign uses obfuscation.

typosquatting

Campaign uses typosquatting.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

Packages in the campaign

campaign:2025-12-loguru-utf8