MAL-2026-19191: Malicious code in voxgramasr (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do when used?
It acts as a loader: it can download and execute code from a supplied URL. The malicious payload is not contained in the package itself, so the code executed may change over time.
What does an attacker need to exploit this?
The package must be installed and used in a way that causes it to retrieve code from a URL. The available data does not identify a separate vulnerability condition or affected configuration.
How can I determine whether my environment is affected?
Check Python dependency manifests, lockfiles, package inventories, build logs, and virtual environments for the PyPI package name voxgramasr. Also investigate systems where it was installed for outbound requests to code-hosting or other remote URLs and for downloaded scripts.
What should I do if this package is present?
Remove voxgramasr from dependencies and environments, prevent it from being installed again, and treat hosts where it was executed as potentially compromised. Review and rotate credentials or secrets accessible to those environments, since the remotely downloaded code is unspecified.