MAL-2026-19193: Malicious code in wavforge (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does the package do that makes it dangerous?
It acts as a loader: it retrieves code from a supplied URL and executes it. The malicious payload is not embedded in the package, so the code delivered remotely can change over time.
What does an attacker need to exploit this?
The package must be installed and used in a way that supplies a URL for the loader to retrieve. The available data does not identify a specific vulnerable version or default execution path.
How can I determine whether I may be affected?
Check dependency manifests, lockfiles, build environments, and installed Python packages for pip/wavforge. Also review execution logs and network activity for instances where the package may have downloaded and run a remote script.