MAL-2026-18167

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/speaksocket/MAL-2026-18167.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18167
Published
2026-10-22T00:29:19Z
Modified
2026-10-29T14:45:08Z
Summary
Malicious code in speaksocket (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4d8c791801cb052f99ffe3ca30fd6dcacb5a3c4c42f6487e94bea779dc9f01b1)

No install-time, import-time, or runtime behavior consistent with credential theft, remote code execution, silent-relay, backdoor, or dependency-chain dropper patterns was observed in this package version. No lifecycle hooks, outbound network calls to attacker-controlled destinations, filesystem persistence, or credential-path reads are present in the shipped files.

Source: kam193 (5045a2695255c6340f6e69b58b13605a27756ccbab63280fb415e755d95be1cd)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/speaksocket",
            "import_time": "2026-10-22T01:26:38.735301519Z",
            "modified_time": "2026-10-22T00:29:19.258459Z",
            "sha256": "5045a2695255c6340f6e69b58b13605a27756ccbab63280fb415e755d95be1cd",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022335",
            "import_time": "2026-10-29T14:37:04.622913875Z",
            "modified_time": "2026-10-29T14:19:36Z",
            "sha256": "4d8c791801cb052f99ffe3ca30fd6dcacb5a3c4c42f6487e94bea779dc9f01b1",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / speaksocket

Package

Name
speaksocket
View open source insights on deps.dev
Purl
pkg:pypi/speaksocket

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "speaksocket-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "3b175d9e9c2d364dc0964d7dced27e26b1830bfc89914cb8b9c509a6cf7933fb",
                "md5": "372aae531bafb5d52e0e736ab96a0615",
                "sha256": "d7fd6fc26640a1e8e9a0dae28e350194576262f586c5ef925f343a2e595441d1"
            }
        },
        {
            "filename": "speaksocket-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "e2b1c55bafecb940ab686945d46a6b6a34485160392a1ac36053c75215364e47",
                "md5": "9011bc70ee2fb72d7a021a812e22ee30",
                "sha256": "dbb7d231e7ebe3967650020a75a67348382a59d23a54111cdcc1dafa582b4184"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/speaksocket/MAL-2026-18167.json"