MAL-2026-19188: Malicious code in phoneliasr (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need in order to exploit this package?
The package is described as a loader that executes code from a supplied URL. Exploitation depends on the package being installed and invoked with, or otherwise receiving, a URL pointing to attacker-controlled code.
Does the package need to contain the final malicious payload to be dangerous?
No. The reported behavior downloads and executes a remote script, so the payload can be hosted separately and changed without republishing the package.
Who is most likely exposed?
Environments that installed or executed the phoneliasr PyPI package are potentially exposed, particularly where it was used to load code from external URLs. The available data does not state whether any specific default configuration triggers this behavior.
What should be checked during triage?
Check dependency and package-install records for phoneliasr, then review execution history for the package and any URLs it was given or contacted. Investigate downloaded scripts and their resulting process, file, and network activity.
What can be done if removal cannot happen immediately?
Prevent the package from reaching external URLs and do not invoke it with untrusted or unknown URLs. This reduces the reported download-and-execute behavior while the package is removed or the environment is investigated.