{"id":"MAL-2026-18778","kind":"package","aliases":["MAL-2026-18778"],"related":[],"title":"Malicious code in logger-libs (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55)\nIn this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-11-spellcheckers\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"logger-libs","fixed":[],"affected":"= 0.4.1; = 0.4.2; = 0.4.3; = 0.4.5; = 0.4.6","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T08:18:27+00:00","first_seen_at":"2026-11-09T09:56:07+00:00","triaged_at":"2026-11-09T09:57:13+00:00","updated_at":"2026-11-09T10:07:50+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':72C '-18778':10A,13A '-2026':9A,12A '2025':71C 'b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55':30C 'base':75C 'campaign':37C,63C,70C,78C 'categori':60C 'clear':65C 'code':2A,55C,90C 'command':94C 'contain':89C 'detail':21C 'download':51C,80C 'edit':24C 'execut':53C,82C,92C 'file':44C 'incarn':34C 'infosteal':69C 'intent':67C 'kam193':29C 'lib':6A 'libs':16A 'like':68C 'limit':96C 'line':27C 'locat':59C 'logger':5A,15A 'logger-lib':4A 'logger-libs':14A 'machin':105C 'mal':8A,11A 'malici':1A,17B,54C,61C,66C,85C 'multipl':43C 'new':33C 'obfusc':79C 'packag':18B,88C 'payload':39C 'per':19C 'probabl':95C 'pypi':7A 'reason':74C 'reconstruct':46C 'remot':58C,84C,93C 'runtim':48C 'script':86C 'set':100C 'sourc':20C,28C 'specif':99C 'spellcheck':73C 'spread':41C 'victim':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["loggerlibs"],"ptokens":["libs","logger"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18778':10A,13A '-2026':9A,12A 'code':2A 'lib':6A 'libs':16A 'logger':5A,15A 'logger-lib':4A 'logger-libs':14A 'mal':8A,11A 'malici':1A 'pypi':7A","search_b":"'malici':17B 'packag':18B","search_c":"'-11':72C '2025':71C 'b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55':30C 'base':75C 'campaign':37C,63C,70C,78C 'categori':60C 'clear':65C 'code':55C,90C 'command':94C 'contain':89C 'detail':21C 'download':51C,80C 'edit':24C 'execut':53C,82C,92C 'file':44C 'incarn':34C 'infosteal':69C 'intent':67C 'kam193':29C 'like':68C 'limit':96C 'line':27C 'locat':59C 'machin':105C 'malici':54C,61C,66C,85C 'multipl':43C 'new':33C 'obfusc':79C 'packag':88C 'payload':39C 'per':19C 'probabl':95C 'reason':74C 'reconstruct':46C 'remot':58C,84C,93C 'runtim':48C 'script':86C 'set':100C 'sourc':20C,28C 'specif':99C 'spellcheck':73C 'spread':41C 'victim':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:18:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18778","url":"https://osv.dev/vulnerability/MAL-2026-18778","severity":"critical","published_at":"2026-11-09T08:18:27+00:00","modified_at":"2026-11-09T09:30:04+00:00","first_seen_at":"2026-11-09T09:56:07+00:00","fetched_at":"2026-11-09T09:56:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}