Someone I know has one of these.

KD1:/ $ pm list packages | grep cpe
package:x.cpe
KD1:/ $ settings get global package_verifier_user_consent
1

Hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm, so Play Protect is enabled and doing nothing about it. Also, “nexus” wasn’t installed, not here at least. Not “system.ntp”, “oemservice” or “sso” either. com.droidlogic.* is just generic AmLogic crap, if there’s a backdoor in there it’s probably a different company. The Google article mentions libexploit.so, which doesn’t exist with a quick find. Neither does libjaguar.so. libbase.so is just a generic file present everywhere, nothing interesting in strings for it. My guess is that it’s geographically locked.

So I am not sure what I am supposed to do with that. I just ran pm disable-user on it, hopefully that’s enough.