MAL-2026-18228: Malicious code in jobwharf (PyPI)

Published Oct 23, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fbfb11d059a4f43447527c793da1228d2bfec1aba386532a3b2eecd00b3a9256) Analysis of jobwharf 0.1.0 for pypi surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no credential or environment harvesting, no fetch-and-execute of remote payloads, no persistence or backdoor mechanisms, and no silent-relay patterns were observed in the shipped files.

Source: kam193 (172e672abed0eeea77b62d2a9dea9999b59ff685b952fec68c70e2b227e0bce6) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

- other

- Downloads and executes a remote malicious script.

Affected Software

1 affected component

pip/jobwharf=0.1.0

Event History

Oct 23, 2026

Advisory Published

via OSV·04:05 PM

Data Sourced

via OSV·04:05 PM

DescriptionAffected Software

Frequently Asked Questions

What behavior makes this package a concern despite the absence of suspicious activity in the analyzed files?

The package is identified as part of a coordinated loader-package campaign. These loaders are intended to execute code from a supplied URL, enabling a remote script to be downloaded and run even though the payload is not embedded in the package.

Did the analysis identify install-time, import-time, or credential-harvesting behavior in jobwharf 0.1.0?

No. Analysis of jobwharf 0.1.0 found no install-time or import-time network activity, credential or environment harvesting, remote payload fetch-and-execute behavior, persistence, backdoors, or silent-relay patterns in the shipped files.

Is the remote payload or its eventual use known from the available data?

No. The malicious payload is not contained in the package, and the reported usage remains unknown. The concern is that the package provides a mechanism to execute code from a given URL.

MAL-2026-18228: Malicious code in jobwharf (PyPI)

Affected Software

Event History

Frequently Asked Questions

What behavior makes this package a concern despite the absence of suspicious activity in the analyzed files?

Did the analysis identify install-time, import-time, or credential-harvesting behavior in jobwharf 0.1.0?

Is the remote payload or its eventual use known from the available data?

Company

Resources

Contact

Frequently Asked Questions

What behavior makes this package a concern despite the absence of suspicious activity in the analyzed files?

Did the analysis identify install-time, import-time, or credential-harvesting behavior in jobwharf 0.1.0?

Is the remote payload or its eventual use known from the available data?