MAL-2026-18155 Malicious code in acoustichub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18164 Malicious code in phonemeprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e734952ed1638d020205fd4c071007902fd7b0b6671f1aa8eeb0b583efa75a08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18170 Malicious code in ttsflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ca06c0d356aef80eb13ae19e8a7e17cacdb0e1d3b1ba0f250387d8b18d110395 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18161 Malicious code in evalstream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00f8be270be4392f91ab130c7e77583408a4e24e858b22522158a61116c0a0d4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18166 Malicious code in speakbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5261cd9950cdef43aa82af72e1a479d8668a37b06d1fce0a6b8ff869e0620ed2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18158 Malicious code in audiokit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae10fa65b7a9cd16dbfc93eae72c57da03db18821aacd99a38e4bfa054df6e16 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18163 Malicious code in phonemeforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8393ec235ace6b8639b9d6c2ee4f6ae74e3311970c073259aa43c39bb36154d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18173 Malicious code in vocabbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18157 Malicious code in asrloom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd20eda3837d1f9497fcbd0cdf6826a2bff936766bac7e8d0a3f8b11ecaf15d3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18160 Malicious code in benchworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 606e74602d9241e80622f42ed81f9040fe733889abd2003a862704c1d2d72595 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18159 Malicious code in benchbridge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e329737ae059eda6e9d4d0e57c74c937cc38746b707cc5dbbceac5387fb6926 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18168 Malicious code in speechprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d32ccbe0ed7b8e97acb3670d4e50b774d36520ddd91c34367170b7c5e88337e3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18165 Malicious code in soundsocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9b50b12b54ecdc99f678332cf4a8e2d333ce5398c1c545eb994d2f368843cb03 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18162 Malicious code in modelworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd8881d21166c1b1d9e519b92d85228a8df0520e31bd5a3d6a3606513b66047a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18174 Malicious code in vocabblend (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f512985b20dc469ed3bd4e8e382b358fdbffa1153f5fcadb3d6dfeeaeeac84a0 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18175 Malicious code in voicekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 963d403cf4d9c68ae8a3047dba639793fc4669e0953662c923c9a1eacb5f5402 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18172 Malicious code in ttsweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf25be0936bf389bd4c150fdda0e6801d5916e7d3c386695ece9360dbb39c085 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18171 Malicious code in ttsprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18169 Malicious code in ttsdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd67309a16135e30efc3aad2f8d234cc48fed3ffdaa4d32b6345cc368963e775 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18176 Malicious code in voxweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 98de0e1f12e0c4b69583e08c1cd46876975b49c6803d93483c136ee2f6e62f68 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18167 Malicious code in speaksocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5045a2695255c6340f6e69b58b13605a27756ccbab63280fb415e755d95be1cd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18156 Malicious code in asrdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f6bd33cecc5263c6ff8d666d61c33ddbe5b487331c1f2edd13873c1eef145b5c This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18154 Malicious code in pipegrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69da6e2696ea51627e314534617b3a5507896dd6375f600ae4a71d84ace79609 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18153 Malicious code in hookgantry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18152 Malicious code in acousticpack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e9796cf3d8fa108f7e354640578e92abd850a9b899dbc8e0e22f14e40bcd4a02 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18139 Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afc8d83a420096900bdccd11b4ed6f45011c624cbc47c25a486576418203f4dd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18142 Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0bda956d0ba9b9905171793e59d4105ec06f8f0aadaa3508b66ad19bdaa10d18 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18144 Malicious code in prosodinetts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f39f72745f4cfbe04c6dd887e7fd8ac45dd9aef3e9892a41f6f7491997f901e This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18137 Malicious code in codecraze (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1811daf51a786c7fc7dfea9a979a5f53626825eca9d18b61220b6366617ecb33 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18147 Malicious code in solivoxtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c512c506dd4828aef5dd993cce389de4500f6c2e3c1906f1440e71cf455c64e7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18148 Malicious code in tessivatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2d8e0f874c40346588bbb4f025cb9be6ac29dc2fc6b95de5b662ac2126a628a1 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18149 Malicious code in vellutts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a36ed984afc7ca3475fe4852ef18158dc5569b049a35f4a23fd9260dc342c795 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18140 Malicious code in grommatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19b2f82a5bea773c2f47efa91e029f047a508d4c8d117eb102728056d0ac5bc3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18151 Malicious code in zennittts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8a405494d56b12c5eabd44355e1b97dd09406522e9e2211193e6df2123592dda This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18134 Malicious code in aurenatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18143 Malicious code in phonoviatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0ad248ff66471a497d4c3a6d16384648636101a927c384cd4870adf920eced97 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18150 Malicious code in voxilaratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 39377b8b4c1d6d3243cb82f3e86bdc38869bf56e3800bf02ae817a1555ddb11b This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18136 Malicious code in brummatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18141 Malicious code in melcuratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18145 Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6297f0fae1c96dd5abefc4dd7f67a51ee7a737d1bb437fcffaed067d44d637a4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18146 Malicious code in shellgrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e23472f83d676f848fc137b96283dd8819ee900b3f371400aa8263bb4f70339 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18135 Malicious code in batchspar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18138 Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18133 Malicious code in journey-test-hellospy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

MAL-2026-18127 Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

MAL-2026-18130 Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

MAL-2026-18128 Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

MAL-2026-18132 Malicious code in libseal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09 In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier...

MAL-2026-18131 Malicious code in iterquarry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier...