MALICIOUS (1) campaign cataloged at 2025-12-10(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-12-loguru-utf8¶
Package clones a popular package (loguru, jsonschema, ...). While it claims to have some additional features, the real change is an added compiled native library which is silently loaded in the background during the importing of the module. The exact behavior is unknown, but the binary is obfuscated
Abuse categories¶
clones_real_package
The package is a clone of a legitimate package or library, but with malicious code added.
native-extension
Campaign uses native-extension.
obfuscation
Code uses obfuscation techniques to hide its true purpose.
typosquatting
The package name is an typosquatting variant of a popular package.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.