MAL-2026-18168

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/speechprobe/MAL-2026-18168.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18168
Published
2026-10-22T00:45:25Z
Modified
2026-10-29T14:45:08Z
Summary
Malicious code in speechprobe (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0efdeb2bf7d6e8d4071d0f6d39bbad679cbca3549d0298b6503dc3974fec20a9)

The package contains no identified install-time, import-time, or runtime behavior that would compromise an installer. No lifecycle hooks performing network I/O, no credential or filesystem reads targeting installer secrets, no outbound exfiltration endpoints, and no fetch-and-execute patterns were observed in the shipped files.

Source: kam193 (d32ccbe0ed7b8e97acb3670d4e50b774d36520ddd91c34367170b7c5e88337e3)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/speechprobe",
            "import_time": "2026-10-22T01:26:38.735959174Z",
            "modified_time": "2026-10-22T00:45:25.724695Z",
            "sha256": "d32ccbe0ed7b8e97acb3670d4e50b774d36520ddd91c34367170b7c5e88337e3",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022328",
            "import_time": "2026-10-29T14:37:04.109747843Z",
            "modified_time": "2026-10-29T14:18:36Z",
            "sha256": "0efdeb2bf7d6e8d4071d0f6d39bbad679cbca3549d0298b6503dc3974fec20a9",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / speechprobe

Package

Name
speechprobe
View open source insights on deps.dev
Purl
pkg:pypi/speechprobe

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "speechprobe-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "bd44d3be56d9652d6817028465546d91b775a3fc42d96986b487e05718ccd1ad",
                "md5": "8ec621a6f58c6d9a61b1eae5ceff3f97",
                "sha256": "7cc3fd86507ccd2e9fe01f5c432a923d4d78b619c2ffd79a652d8f8d69abeed4"
            }
        },
        {
            "filename": "speechprobe-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "2ff2f0a5405da73a6b2d6e91bfe7da4cf75fcfb253c635a77fbc4f20a22854fa",
                "md5": "adcf8b05c1c6e80b916bd1ceeeb4ae91",
                "sha256": "711c1702ba23f239137b66808e7cdc77927f9a48d42ebbadb2e108f3a28e3937"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/speechprobe/MAL-2026-18168.json"