MAL-2026-17918

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tonemaptts/MAL-2026-17918.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17918
Published
2026-10-17T17:06:12Z
Modified
2026-10-29T14:45:11Z
Summary
Malicious code in tonemaptts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0d30c3584f91da98dea7065e548acd378e0c1fa8abe692bbfd20c4abb384e05e)

Package tonemaptts version 0.1.0 was scanned (6 files). No install-time network I/O, no credential or environment harvesting, no suspicious lifecycle hooks, no obfuscated payloads, and no outbound connections to attacker-controlled destinations were observed in the package contents.

Source: kam193 (19491cfac57ebbc5106857c286eb420bb2c84f246781670579fc4311cb7d1cad)

The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-emberlytts

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-emberlytts/tonemaptts",
            "import_time": "2026-10-17T17:38:26.3053808Z",
            "modified_time": "2026-10-17T17:06:12.628738Z",
            "sha256": "19491cfac57ebbc5106857c286eb420bb2c84f246781670579fc4311cb7d1cad",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022351",
            "import_time": "2026-10-29T14:37:05.331162461Z",
            "modified_time": "2026-10-29T14:21:37Z",
            "sha256": "0d30c3584f91da98dea7065e548acd378e0c1fa8abe692bbfd20c4abb384e05e",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / tonemaptts

Package

Name
tonemaptts
View open source insights on deps.dev
Purl
pkg:pypi/tonemaptts

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "tonemaptts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "64c35e45d1bb2f8ce71a523fce98f321a67a6df17dfb40f007d7d36f06f8be9d",
                "md5": "d9eb654718021d73724b73bb3c00b017",
                "sha256": "a908f3365e1e59aaaa6bbb9fbf4723fdc8b04091a862e4d657dbaab53807d844"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/tonemaptts/MAL-2026-17918.json"