{"id":"MAL-2026-17915","title":"Malicious code in novalithtts (PyPI)","summary":"Malicious code in novalithtts (PyPI)","severity":"critical","exploited":true,"vendor":"novalithtts","product":"novalithtts","ecosystem":"pip","affected":["novalithtts"],"published":"2026-10-17","updated":"2026-10-29","sourceUpdated":"2026-10-29T14:45:08.588894625Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17915","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/novalithtts"},{"url":"https://pypi.org/project/novalithtts/0.1.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-18T11:51:09.852Z","slug":"MAL-2026-17915","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4bb01cabcce365078bca95c60c71c3b5b7e131a0779772cccf2706d5895a1c9f)\nAnalysis of the package contents surfaced no install-time or import-time behavior affecting the installer. No lifecycle scripts, no outbound network calls, no reads of installer credential paths, no obfuscated payloads, and no dropper or persistence mechanisms were identified in the shipped files.\n\n## Source: kam193 (4d136563fb3f5bd0febb4dc01f0af8d3ce9638271f1416f814d126fb49239840)\nThe package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-emberlytts\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n\n\n## Affected packages\n\n- `novalithtts`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}