MAL-2026-19208: Malicious code in voxcpmttslora (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (b40228df9bac54fb38c660c1a82e16e409a25f416bdd35e4d50339abf8891f2d) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this package?
An attacker needs a target to install and run the package in an environment that can retrieve code from a supplied remote URL. The package acts as a loader that downloads and executes a remote script rather than containing the final payload itself.
What should teams do if this package is present?
Treat installations as potentially compromised, stop executing the package, and remove it from dependency manifests and build environments. Review systems where it was installed or run for remote-script retrieval and execution activity.
Does the package need to include a payload to be dangerous?
No. The reported behavior is to download and execute code from a remote URL, allowing the payload to be changed or supplied after installation.