2025-11-spellcheckers campaign: logger-libs (PyPI) — malicious package downloads and executes remote payload (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub Advisory Database (GHSA-vw9j-7fh8-35gf, published 2026-11-09) flags the PyPI package logger-libs as malicious under the '2025-11-spellcheckers' campaign tracked by OpenSSF and researcher kam193. Versions 0.4.1, 0.4.2, 0.4.3, 0.4.5 and 0.4.6 contain obfuscated code split across multiple files and reconstructed at runtime, which downloads and executes a malicious script from a remote location and can run remote commands on the victim's machine. The campaign is assessed as clearly malicious, likely infostealer functionality, and has been linked to Python RAT delivery in related packages. No patched versions exist; the package should be treated as compromised and removed. Anyone who installed these versions is affected.
What to do
- Immediately uninstall logger-libs and remove it from all requirements files, lockfiles and CI images
- Audit affected hosts for signs of compromise, credential theft and persistence; rotate secrets, tokens and keys accessible from those environments
- Check dependency trees and build caches for other packages from the 2025-11-spellcheckers campaign
- Block the package and its indicators in artifact repositories and proxy caches
- Review pip install logs to identify when and where the malicious versions were installed
Sources
All live incidents on Threat Watch
