MAL-2026-18238: Malicious code in taskquay (PyPI)

Published Oct 23, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (62e5ff7b7f42b9a62e4e143ad3bec7df066ea92c529f6e7b908c531b13abf237) The package taskquay 0.1.0 was examined and no credential access, outbound network activity, install-time code execution, dropper, silent-relay, or persistence mechanism was observed in its contents. No lifecycle hooks or import-time side effects of concern are present.

Source: kam193 (692f4bcca72a6b53c989001619446e8b3b5bd66716674ca8230baa6d9d4c60a5) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

- other

- Downloads and executes a remote malicious script.

Affected Software

1 affected component

pip/taskquay=0.1.0

Event History

Oct 23, 2026

Advisory Published

via OSV·03:55 PM

Data Sourced

via OSV·03:55 PM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this package?

The package is described as a loader that executes code from a URL. Exploitation depends on a user or environment installing and using the package in a way that causes it to retrieve and execute remotely supplied code.

Was malicious behavior observed during package installation or import?

The examined taskquay 0.1.0 contents showed no install-time code execution, lifecycle hooks, or import-time side effects of concern. The reported risk is remote code loading rather than behavior observed during installation or import.

What should teams do if they have taskquay 0.1.0 in their environment?

Treat the package as malicious and remove it from dependencies and deployed environments. Review how it was used, especially for any configured or supplied URLs that could have caused remote code to be downloaded and executed.

MAL-2026-18238: Malicious code in taskquay (PyPI)

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this package?

Was malicious behavior observed during package installation or import?

What should teams do if they have taskquay 0.1.0 in their environment?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this package?

Was malicious behavior observed during package installation or import?

What should teams do if they have taskquay 0.1.0 in their environment?