MAL-2026-19186: Malicious code in lumitts (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do when used?
It acts as a loader that obtains code from a supplied URL and executes it. The malicious payload is not included in the package itself, so the behavior and impact depend on the remotely provided script.
What does an attacker need in order to exploit this?
The package must be installed and used in a way that provides or causes it to use a URL for remote code. Successful execution also depends on the remote script being reachable at the time it is loaded.
How can I determine whether my environment may be affected?
Check Python dependencies, package installation records, lockfiles, build artifacts, and deployment images for the lumitts package. Also investigate any use of URLs passed to or associated with the package, since those may identify remotely loaded code.