MAL-2026-19182: Malicious code in flowmetry (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
Does the package include the final malicious payload?
No. It is described as a loader package: it downloads and executes a remote script from a supplied URL rather than containing the payload itself.
What would make an environment exposed to this activity?
An environment would need to install and use the flowmetry package in a way that causes it to retrieve and execute code from a given URL. The supplied data does not identify any affected version range or configuration prerequisite.
How can I check whether this is relevant to my environment?
Review Python package inventories, build dependencies, and deployment artifacts for the PyPI package named flowmetry. The available data does not provide version-specific indicators or hashes for installed package files.