MAL-2026-17913

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/emberlytts/MAL-2026-17913.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17913
Published
2026-10-17T17:04:22Z
Modified
2026-10-29T14:45:10Z
Summary
Malicious code in emberlytts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b082c02a5246d61d7d9a5392961f29f51bf9db1aebdb9901b79fa363f173ba4e)

Analysis of emberlytts 0.1.0 across 6 files surfaced no install-time or import-time network activity, no credential or environment reads targeting installer secrets, no lifecycle scripts fetching or executing remote code, and no indicators of exfiltration, persistence, or backdoor behavior. No suspicious patterns were matched.

Source: kam193 (c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547)

The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-emberlytts

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-emberlytts/emberlytts",
            "import_time": "2026-10-17T17:38:26.301706346Z",
            "modified_time": "2026-10-17T17:04:22.376988Z",
            "sha256": "c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022350",
            "import_time": "2026-10-29T14:37:05.299000476Z",
            "modified_time": "2026-10-29T14:21:31Z",
            "sha256": "b082c02a5246d61d7d9a5392961f29f51bf9db1aebdb9901b79fa363f173ba4e",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / emberlytts

Package

Name
emberlytts
View open source insights on deps.dev
Purl
pkg:pypi/emberlytts

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "emberlytts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "50325ed54781de16fe0423606330c7c3d272f187245da15c58bbe629244be325",
                "md5": "ef85330547d734a81bfc5e6233ec4a13",
                "sha256": "8ef541850c83b166c7b3819a2c152516ebe32efba2e9ff1107a1cc92a8b7a351"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/emberlytts/MAL-2026-17913.json"