MAL-2026-19185: Malicious code in inframetric (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do that creates the risk?
It acts as a loader that can retrieve and execute code from a URL. The malicious payload is not contained in the package itself, so the code run may be controlled remotely.
What would an attacker need to exploit this?
The package would need to be installed and executed in an environment that can reach the URL supplying the remote script. The available data does not identify a separate vulnerability trigger or affected configuration.
How can I determine whether I am affected?
Check Python dependency manifests, lockfiles, package inventories, build environments, and deployed environments for the PyPI package named inframetric. Any installation should be treated as potentially affected because the package is identified as part of a malicious loader campaign.