MAL-2026-19207: Malicious code in qwen3ttsui (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (2c64f86bb29e534513cdf30a837f2ff458b45eac42c8e35f191b952481ef7c3f) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need in order to exploit this package?
A victim would need to install and run the package in an environment that can reach the attacker-controlled URL. The package acts as a loader that downloads and executes a remote script, so the payload can be supplied after installation.
Are installations already exposed even though the malicious payload is not included in the package?
Yes. The package contains code intended to fetch and execute code from a remote URL; the malicious payload does not need to be bundled with the package for that execution path to be dangerous.
What should teams do if this package is present?
Treat systems where it was installed or executed as potentially compromised. Remove the package, prevent outbound access to the remote script source where possible, and investigate for downloaded or executed scripts and resulting system changes.