MAL-2026-18155

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/acoustichub/MAL-2026-18155.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18155
Published
2026-10-22T00:58:24Z
Modified
2026-10-29T14:45:10Z
Summary
Malicious code in acoustichub (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a31d5b9e7319cd715f9cfcd79aecbc918ab308c3e52a9abf132b026f059ee62f)

Analysis of acoustichub 0.1.0 did not surface install-time execution hooks, outbound network behavior, credential or environment reads, or other patterns consistent with supply-chain attacks against installers.

Source: kam193 (8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/acoustichub",
            "import_time": "2026-10-22T01:26:38.71175528Z",
            "modified_time": "2026-10-22T00:58:24.751826Z",
            "sha256": "8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022340",
            "import_time": "2026-10-29T14:37:04.919549933Z",
            "modified_time": "2026-10-29T14:20:09Z",
            "sha256": "a31d5b9e7319cd715f9cfcd79aecbc918ab308c3e52a9abf132b026f059ee62f",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / acoustichub

Package

Name
acoustichub
View open source insights on deps.dev
Purl
pkg:pypi/acoustichub

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "acoustichub-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "9fc7f409e58b12e394d0834ddcccb3135429d5b51cbba07c53d67343fd83c2cb",
                "md5": "848d964b73fde4d16a6afcfd9d6d8dc8",
                "sha256": "638281c934a5652f6e8959d4648c401997c29d910b5bdb44caa04751d419ddba"
            }
        },
        {
            "filename": "acoustichub-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "9bcd49a97980fce07fc696b56e9e1a40bd2e2e3d45f6ef2c9820ba80ff14e6bc",
                "md5": "a264c60ea4dba8e8c410f68cb2740e38",
                "sha256": "798291a8f0d4147fc669619393c7d3d85322591f2dfe121efcbac4152a12748b"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/acoustichub/MAL-2026-18155.json"