MAL-2026-18171

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ttsprobe/MAL-2026-18171.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18171
Published
2026-10-22T00:31:59Z
Modified
2026-10-29T14:30:37Z
Summary
Malicious code in ttsprobe (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b3ac396ae8349e2b92e5405345d32a2be4358267a33a1e26b1dd9d062e420443)

ttsprobe 0.1.0 (PyPI) was inspected across 10 files. No install-time or import-time outbound network activity, credential or environment scraping, filesystem persistence, dropper, backdoor, or silent-relay behavior was identified in the shipped contents. No lifecycle hooks or PEP 517 build-backend network I/O were found.

Source: kam193 (d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/ttsprobe",
            "import_time": "2026-10-22T01:26:38.738560951Z",
            "modified_time": "2026-10-22T00:31:59.053718Z",
            "sha256": "d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022224",
            "import_time": "2026-10-29T14:14:35.675216358Z",
            "modified_time": "2026-10-29T14:05:00Z",
            "sha256": "b3ac396ae8349e2b92e5405345d32a2be4358267a33a1e26b1dd9d062e420443",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / ttsprobe

Package

Name
ttsprobe
View open source insights on deps.dev
Purl
pkg:pypi/ttsprobe

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "ttsprobe-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "b11e08bdae8d3070953b568b7c3ebb11a89c227a584b42d38e12ca1ae7d85a12",
                "md5": "b0ff3186cfa7df2d694c1c4c21e70ddb",
                "sha256": "2d4aaa9e2134b552239746677c2025f28fd816a066a2e304a8195373576068bd"
            }
        },
        {
            "filename": "ttsprobe-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "4217ce58f9013c637bc4824d2f75b7c1ea1d5cfa6d18563b36c90e7c5a084f7d",
                "md5": "fd1443008bb342573de619f79ec1196d",
                "sha256": "043e45c685ffb68e6ee5c98fc2cfc75dfb9b095ca922279321c01cec9df4af8e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ttsprobe/MAL-2026-18171.json"