MAL-2026-19181: Malicious code in ferrotts (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does the package do that makes it dangerous?
It acts as a loader that downloads and executes code from a supplied URL. The package itself may not include the final payload, allowing the remotely hosted script to change over time.
What does an attacker need to exploit this?
An attacker would need a user or automated process to install and run the package, then provide or influence the URL from which it retrieves code. The available information does not identify a specific affected configuration or execution path.
How can I determine whether my environment may be affected?
Check Python dependencies, package installation records, build scripts, and deployed environments for the PyPI package name ferrotts. Also review any systems where it was executed for URLs used to retrieve remote scripts.
What should I do if the package is present?
Treat installations as potentially compromised, stop executing the package, and remove it from dependency manifests and build workflows. Review and investigate any remote code retrieved or executed by environments where it was used.