MAL-2026-18163

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/phonemeforge/MAL-2026-18163.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18163
Published
2026-10-22T00:56:00Z
Modified
2026-10-29T14:45:11Z
Summary
Malicious code in phonemeforge (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (642b1da8f4deb8f186e5a24a7df2363db4a2a39f749bb59881a9621df7e62926)

The package was scanned and no indicators of installer-facing harm were found: no install-time or import-time network activity, no credential or environment reads, no outbound exfiltration endpoints, no obfuscated payloads, and no lifecycle hooks performing privileged or remote actions.

Source: kam193 (d8393ec235ace6b8639b9d6c2ee4f6ae74e3311970c073259aa43c39bb36154d)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/phonemeforge",
            "import_time": "2026-10-22T01:26:38.728465335Z",
            "modified_time": "2026-10-22T00:56:00.373604Z",
            "sha256": "d8393ec235ace6b8639b9d6c2ee4f6ae74e3311970c073259aa43c39bb36154d",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022329",
            "import_time": "2026-10-29T14:37:04.165623923Z",
            "modified_time": "2026-10-29T14:18:45Z",
            "sha256": "642b1da8f4deb8f186e5a24a7df2363db4a2a39f749bb59881a9621df7e62926",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / phonemeforge

Package

Name
phonemeforge
View open source insights on deps.dev
Purl
pkg:pypi/phonemeforge

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "phonemeforge-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "7dc509aff3cd6f7d9b59ec1aa9c64d7cd4f5131717b76247c1da2b6ef623f99a",
                "md5": "b430c003d3674cc1a8c4396366c5733d",
                "sha256": "0b7db4f575f6e38ef8f53e9ac658a74adbea441e22b321aa9774282764553ae5"
            }
        },
        {
            "filename": "phonemeforge-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "3707c5a4e2206f62a38b809675f62ca431a5c39f36aad3008e08610956ca4dda",
                "md5": "e5f4a638282fab2bdf4d1fd20102011f",
                "sha256": "d16cf0b6804ec7a9f045d413a5ed59d2b0bc69bf893b0921ae5c104f75e20976"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/phonemeforge/MAL-2026-18163.json"