MAL-2026-11413

--- _-= Per source details. Do not edit below this line.=-_

## Source: kam193 (20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6) Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-reguestsc

Reasons (based on the campaign):

- typosquatting

- Downloads and executes a remote executable.

- malware

- clones-real-package

- spyware-like

- infostealer