MAL-2026-19179: Malicious code in eulaliatts (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
Does the package contain the final malicious payload?
No. It is described as a loader package: the payload is retrieved from a URL and executed remotely, so the package itself may not include the final malicious script.
What is required for the malicious behavior to occur?
The loader must be able to obtain code from its configured remote URL and execute it. The available information does not identify the remote payload or describe its usage.
How can I determine whether my environment is affected?
Check whether eulaliatts is present in your Python dependencies or installed packages. No affected version range, package hash, or additional detection indicator is provided.
Is this an isolated package issue?
No. The package is identified as part of a coordinated campaign involving similar deceptive loader packages that download and execute remote scripts.