MAL-2026-19199: Malicious code in acustoviasr (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do when used?
It acts as a loader: it can obtain code from a supplied URL and execute it. The malicious payload is not embedded in the package itself, so the code delivered remotely may change over time.
What does an attacker need to exploit this?
A user or automated build would need to install and run the package in a context where it is given or reaches a URL for remote code. Successful execution would allow the remotely downloaded script to run in that environment.
How can I determine whether my environment may be affected?
Check dependency manifests, lockfiles, package installation records, and build logs for the PyPI package name acustoviasr. Also review systems where it was installed for execution activity and outbound requests associated with retrieving remote scripts.
What should I do if this package is present?
Remove it from dependencies and prevent it from being installed or executed in builds and runtime environments. Treat environments where it ran as potentially exposed to remotely supplied code and investigate the downloaded or executed script activity.