MAL-2026-18149

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vellutts/MAL-2026-18149.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18149
Published
2026-10-21T23:05:45Z
Modified
2026-10-29T14:30:45Z
Summary
Malicious code in vellutts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1ce772257825bac5182114b520a266d4541d9fc558388c1b845d48ec0cc629b1)

No install-time, import-time, or runtime behavior in this package version indicates exfiltration, remote code execution, credential access, silent relay, backdoor, or self-propagation. No lifecycle hooks fetching remote content, no reads of installer-secret paths, and no hardcoded attacker-controlled destinations were observed in the shipped files.

Source: kam193 (a36ed984afc7ca3475fe4852ef18158dc5569b049a35f4a23fd9260dc342c795)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • other

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/vellutts",
            "import_time": "2026-10-21T23:40:12.301446346Z",
            "modified_time": "2026-10-21T23:05:45.621924Z",
            "sha256": "a36ed984afc7ca3475fe4852ef18158dc5569b049a35f4a23fd9260dc342c795",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/vellutts",
            "import_time": "2026-10-22T01:26:38.739931293Z",
            "modified_time": "2026-10-21T23:05:45.621924Z",
            "sha256": "203ca361d0fb847909fba3b2adccc5b57cf869fd28d40b456fc60c755accfbaf",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022170",
            "import_time": "2026-10-29T14:14:31.653745542Z",
            "modified_time": "2026-10-29T13:57:55Z",
            "sha256": "1ce772257825bac5182114b520a266d4541d9fc558388c1b845d48ec0cc629b1",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/vellutts",
            "import_time": "2026-10-29T14:14:43.213584293Z",
            "modified_time": "2026-10-21T23:05:45.621924Z",
            "sha256": "c1a9f6d7832c5e236867feefbd73019ac8338356a6553b14ef8385cab654b721",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / vellutts

Package

Name
vellutts
View open source insights on deps.dev
Purl
pkg:pypi/vellutts

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "vellutts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "f15591e7591f3df02f747f6c27d581d77484810ffb617aec904f7b9d1a7e1842",
                "md5": "2cdd1e349a663c614c46ea28646b7970",
                "sha256": "c9b02fa970d6be41fa76c1b0bebd9ea54b07fff60f386a5a316824e865611b29"
            }
        },
        {
            "filename": "vellutts-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "d250def5a5aa12e09d392a1e0c8455ed523d765dd6faec6dbfe23029e7498d23",
                "md5": "070e6ab6bfabb962ffe4bb0102f6f913",
                "sha256": "02f483e313c6d1aacebcd041434d078073cf2b15d2dc029997e01ed2de186e35"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vellutts/MAL-2026-18149.json"