MAL-2026-19187: Malicious code in melstagen (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
Are specific affected versions or package artifacts identified?
No version range, release identifier, or file hash for the PyPI package is provided in the available data.
Is the remote payload or observed victim usage known?
No. The source states that the loader packages do not contain the malicious payload and that their usage remains unknown.
What execution capability is attributed to this package?
It is described as a loader that can download and execute a remote script from a supplied URL.