MAL-2026-19206: Malicious code in garvisometerui (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (09877eb0403bbdcc0057b40370627c99965eaf5b4d8215cc4b23ea8c089bc9b8) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does this package do when used?
It is described as a loader that obtains code from a provided URL and executes it. The package itself may not contain the final payload, because the remotely retrieved script can supply that code.
What does an attacker need to exploit this?
The package's behavior depends on a URL being provided for it to fetch code from. The available data does not specify the installation-time trigger, command, or application workflow that causes the remote code to execute.
Who is exposed?
Users or environments that install and use the pip package garvisometerui may be exposed, particularly where it is given a URL controlled by an untrusted party. The campaign is assessed as coordinated and malicious.
What can be done before the exact payload is known?
Do not install or use garvisometerui, and remove it from environments where it has been introduced. Review package usage and logs for URLs supplied to the loader and for resulting remote script downloads or execution.