MAL-2026-17920

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voltswannts/MAL-2026-17920.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17920
Published
2026-10-17T17:04:54Z
Modified
2026-10-29T14:45:12Z
Summary
Malicious code in voltswannts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5740f5637c15349ecbe95721abb18891aa6c18dcfb05adbb698ccfe505ae5a72)

The package voltswannts 0.1.0 on PyPI contains 6 scanned files with no behaviors indicating supply-chain attack against installers. No install-time or import-time network activity, no credential or filesystem reads targeting installer secrets, no shell execution of fetched content, no lifecycle or build-backend side effects, and no obfuscated payloads were observed.

Source: kam193 (5fa306d5f7de491546822f6b026c35cc395d7d379258b7a8382b50468ce708b2)

The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-emberlytts

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-emberlytts/voltswannts",
            "import_time": "2026-10-17T17:38:26.306817132Z",
            "modified_time": "2026-10-17T17:04:54.343328Z",
            "sha256": "5fa306d5f7de491546822f6b026c35cc395d7d379258b7a8382b50468ce708b2",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022348",
            "import_time": "2026-10-29T14:37:05.205136402Z",
            "modified_time": "2026-10-29T14:21:15Z",
            "sha256": "5740f5637c15349ecbe95721abb18891aa6c18dcfb05adbb698ccfe505ae5a72",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / voltswannts

Package

Name
voltswannts
View open source insights on deps.dev
Purl
pkg:pypi/voltswannts

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "voltswannts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "236345d8b28c9e1178c1862540ca88867006abf7b226f9fba6d04e2005319238",
                "md5": "0b0d598caf76f7b1ed0e328663427d3f",
                "sha256": "be01de90e273dcf2077885a748a781841486b553337e8af19c9542bed36b8fc4"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voltswannts/MAL-2026-17920.json"