MAL-2026-19183: Malicious code in garviscope (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do after installation or execution?
It acts as a loader that retrieves and executes code from a supplied URL. The malicious payload is not contained in the package itself, so the code ultimately run can be changed remotely.
What does an attacker need to exploit this?
The package needs to be used in a way that provides or triggers a URL for the loader. The available information does not specify the exact invocation path or configuration required.
How can I determine whether my environment may be affected?
Check whether pip installed or dependency records reference the garviscope package. Also review build, deployment, and runtime logs for use of the package and for unexpected remote script downloads or execution.