MAL-2026-18135

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/batchspar/MAL-2026-18135.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18135
Published
2026-10-21T23:02:49Z
Modified
2026-10-29T14:45:04Z
Summary
Malicious code in batchspar (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ab64feb6e332be8ba2d37c9d1efdc21148c1e9b0ff1f849bd35d33dee2602a4f)

Analysis of batchspar 0.1.0 surfaced no indicators of installer harm. No install-time or import-time network activity, no credential or environment scraping, no dropper or fetch-and-execute behavior, no silent-relay path, and no backdoor mechanism were observed across the scanned files.

Source: kam193 (76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • other

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/batchspar",
            "import_time": "2026-10-21T23:40:12.287752365Z",
            "modified_time": "2026-10-21T23:02:49.957472Z",
            "sha256": "76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/batchspar",
            "import_time": "2026-10-22T01:26:38.718988332Z",
            "modified_time": "2026-10-21T23:02:49.957472Z",
            "sha256": "a0ffed3bb35d644df0404d391c6106b745854bad5433c7ea875d898d89e17e92",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/batchspar",
            "import_time": "2026-10-29T14:14:43.206956773Z",
            "modified_time": "2026-10-21T23:02:49.957472Z",
            "sha256": "2c46859f448d73ee7b879de767d3590372b49b29345cd5e553b1cf318061f118",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022337",
            "import_time": "2026-10-29T14:37:04.72007451Z",
            "modified_time": "2026-10-29T14:19:50Z",
            "sha256": "ab64feb6e332be8ba2d37c9d1efdc21148c1e9b0ff1f849bd35d33dee2602a4f",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / batchspar

Package

Name
batchspar
View open source insights on deps.dev
Purl
pkg:pypi/batchspar

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "batchspar-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "a6538b0540c14ccf60825f91f2ab65ebd5af156ff6a150bea389db06b830a1a3",
                "md5": "2a92266ef02e0cb6517bf21fbfdafe37",
                "sha256": "ded8300f01a0f4d97a32518e20ee40e99714a9b2a56f1e9aaf3031b1ab9d54ab"
            }
        },
        {
            "filename": "batchspar-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "ef14f0f68905750fff9c0f0fdfdfde0abd263755485f36b76ba94150dd596a0d",
                "md5": "82b7b2fc51846f086546e813f24f7bd3",
                "sha256": "57dcbd910daacd5790d9592cb083b514bad491fea0537b2ef435c0baff6bea42"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/batchspar/MAL-2026-18135.json"