PyPI Installation of termncolor with Hidden colorinal/uuid32-utils Dependency

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•1•7

Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.