MAL-2026-19184: Malicious code in garvisuite (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What capability does this package provide to an attacker?
It is described as a loader that executes code from a URL supplied to it. The package does not need to contain the final payload itself, because it can download and run a remote script.
Is the package part of an isolated incident?
No. It is identified as part of the 2026-10-voice-synthesis-profiles campaign, which consists of similar coordinated loader packages intended to provide deceptive ways to load malicious code.
What should teams check when assessing exposure?
Check whether garvisuite was installed through pip and whether it was invoked with a URL or otherwise used to retrieve remote code. Review relevant installation and execution activity for downloaded scripts or unexpected outbound requests.