---
id: MAL-2026-17913
title: Malicious code in emberlytts (PyPI)
summary: Malicious code in emberlytts (PyPI)
severity: critical
exploited: true
vendor: emberlytts
product: emberlytts
ecosystem: pip
affected:
  - emberlytts
published: '2026-10-17'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T14:45:10.506988824Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17913'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/emberlytts'
  - url: 'https://pypi.org/project/emberlytts/0.1.0/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-18T11:51:09.851Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b082c02a5246d61d7d9a5392961f29f51bf9db1aebdb9901b79fa363f173ba4e)
Analysis of emberlytts 0.1.0 across 6 files surfaced no install-time or import-time network activity, no credential or environment reads targeting installer secrets, no lifecycle scripts fetching or executing remote code, and no indicators of exfiltration, persistence, or backdoor behavior. No suspicious patterns were matched.

## Source: kam193 (c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547)
The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-emberlytts


Reasons (based on the campaign):


 - other


 - Downloads and executes a remote malicious script.


## Affected packages

- `emberlytts`

## Remediation

Refer to the advisory for the patched release.