Malicious Package Affecting loquru package, versions [0,]
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LOQURU-11426549
- published3 Aug 2025
- disclosed1 Aug 2025
- creditKamil Mańkowski
Introduced: 1 Aug 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the loquru package.
Overview
loquru is a malicious package.
This package contains a malicious code and uses "typosquatting" to bait unaware users to install it.
The malicious loquru package pretends to be the popular loguru library. It hides malicious code within a string of whitespace, which is executed upon import, leading to the download and execution of further scripts from a remote server, with one script attempting to run with root privileges.