MAL-2026-19180: Malicious code in evalometer (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
Does the package contain the malicious payload itself?
The package is described as a loader and does not contain the payload locally. It downloads and executes code from a supplied URL, allowing the remotely hosted script to provide the malicious behavior.
Is this believed to be an isolated package?
No. It is identified as part of the 2026-10-voice-synthesis-profiles campaign, which consists of similar loader packages intended to provide deceptive ways to load malicious code.