MAL-2026-19192: Malicious code in voxrelitts (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this package?
An attacker needs a victim to install and execute the package in an environment that can reach an attacker-controlled URL. The package acts as a loader that downloads and executes remote code, so the payload can be changed after installation.
Are environments affected by default?
Only environments where voxrelitts has been installed and its code is executed are exposed based on the available information. The data does not establish that it is installed by default by any other software.
What should be done if the package is present?
Treat systems where the package was installed or run as potentially compromised, remove it from dependencies, and prevent it from executing. Review network activity for downloads from URLs used by the package and investigate any retrieved scripts or resulting process activity.
How can teams determine whether they may be affected?
Check dependency manifests, lockfiles, package indexes, build logs, and Python environments for voxrelitts. Also review CI/CD and developer workstation records for installations or executions, because the package's malicious behavior is remote-script retrieval and execution.