Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-reguestsc

Reasons (based on the campaign):

• typosquatting

• Downloads and executes a remote executable.

• malware

• clones-real-package

• spyware-like

• infostealer