2025-11-spellcheckers campaign: log-utils-sdk (PyPI) — malicious clone downloads second-stage Python RAT (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub advisory GHSA-gm8f-99q4-fpjh (published 2026-10-30) flags the PyPI package log-utils-sdk version 0.4.1 as malicious, part of the '2025-11-spellcheckers' campaign tracked by OpenSSF and kam193. The package is a clone of a legitimate library containing hidden, obfuscated code that runs on import, downloads a second-stage payload, and spawns a background process that periodically contacts a remote host awaiting further commands — effectively a Python RAT capable of executing remote commands, with likely infostealer intent. Anyone who installed log-utils-sdk 0.4.1 is affected. There are no patched versions; the package is malware and should be removed, not upgraded.
What to do
- Check environments and lockfiles for log-utils-sdk (any version, especially 0.4.1) and remove it immediately
- Treat affected machines as compromised: isolate, reimage, and rotate credentials, tokens, and secrets accessible from them
- Hunt for the background beacon process and outbound connections to the remote host described in the advisory
- Audit PyPI dependencies for other packages tied to the 2025-11-spellcheckers campaign and review install logs for suspicious installs
- Block the package in artifact registries/proxy caches and enforce dependency scanning and allowlisting
Sources
All live incidents on Threat Watch
