MAL-2026-18145

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/quillonatts/MAL-2026-18145.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18145
Published
2026-10-21T23:03:57Z
Modified
2026-10-29T14:30:37Z
Summary
Malicious code in quillonatts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d)

The package quillonatts 0.1.0 does not exhibit traced behavior consistent with supply-chain attack shapes. No install-time or import-time outbound network activity, no credential or environment-variable harvesting, no shell execution of fetched content, no persistence mechanism, and no silent-relay or backdoor code paths were observed in the shipped files.

Source: kam193 (6297f0fae1c96dd5abefc4dd7f67a51ee7a737d1bb437fcffaed067d44d637a4)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • other

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/quillonatts",
            "import_time": "2026-10-21T23:40:12.299538841Z",
            "modified_time": "2026-10-21T23:03:57.790467Z",
            "sha256": "6297f0fae1c96dd5abefc4dd7f67a51ee7a737d1bb437fcffaed067d44d637a4",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/quillonatts",
            "import_time": "2026-10-22T01:26:38.731853286Z",
            "modified_time": "2026-10-21T23:03:57.790467Z",
            "sha256": "4cd0deeb3912769b29f12e5e46746f91dca073deab7db7681bb28a16a7fd9aee",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022172",
            "import_time": "2026-10-29T14:14:31.804771179Z",
            "modified_time": "2026-10-29T13:58:13Z",
            "sha256": "fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/quillonatts",
            "import_time": "2026-10-29T14:14:43.211785533Z",
            "modified_time": "2026-10-21T23:03:57.790467Z",
            "sha256": "519382320ceea2dbd5b9465d96aeccb6ab8b1f7f12dcac2d7ddc4ae0189abc7d",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / quillonatts

Package

Name
quillonatts
View open source insights on deps.dev
Purl
pkg:pypi/quillonatts

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "quillonatts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "b1a9567c43bff4ebc949805a3aabac492c6837eb81a37a1521c13e172d825582",
                "md5": "ff35092eb9474bbcdac5ae20bcff5220",
                "sha256": "a8157c2fb4ada9abff99b27cdb2f74704de04068e8bf2138b7cec38d15b2f251"
            }
        },
        {
            "filename": "quillonatts-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "23873210a511134505b680e6385076a01fe287bdf3c53c3dbdeaf82ef2896515",
                "md5": "71277aa914a4a9ecd2d7b4384248bb28",
                "sha256": "128cbf48e0f6838bc6f277561f8c5c7f0a1b7c1b698ee55f3f5b82b0925b16a1"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/quillonatts/MAL-2026-18145.json"