MAL-2026-18173

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vocabbench/MAL-2026-18173.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18173
Published
2026-10-22T00:55:35Z
Modified
2026-10-29T14:45:11Z
Summary
Malicious code in vocabbench (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4e1091de0d2cae2b06d37e8bb178f125540f3cbd35aab2666e0ace031f04cb47)

No install-time, import-time, or runtime behavior indicative of credential theft, remote code execution, silent relay, backdoor, or dropper activity was observed in this package version. No lifecycle hooks performing network I/O, no.pth file side effects, and no top-level module code reading installer secrets or contacting non-first-party destinations were identified.

Source: kam193 (dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/vocabbench",
            "import_time": "2026-10-22T01:26:38.740680629Z",
            "modified_time": "2026-10-22T00:55:35.303423Z",
            "sha256": "dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022330",
            "import_time": "2026-10-29T14:37:04.280377651Z",
            "modified_time": "2026-10-29T14:18:55Z",
            "sha256": "4e1091de0d2cae2b06d37e8bb178f125540f3cbd35aab2666e0ace031f04cb47",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / vocabbench

Package

Name
vocabbench
View open source insights on deps.dev
Purl
pkg:pypi/vocabbench

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "vocabbench-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "5053c22532eb7347c26e900fd989ed013d0b79886ee9f2620abe3a3019d47a8b",
                "md5": "f2783202a8c3e23a8ec63a3ee26eba4a",
                "sha256": "6f25a4c2c07cbe4e399cd90ff8652951b83af3170e7b59f358afbbb3f944a546"
            }
        },
        {
            "filename": "vocabbench-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "dcf4d3cefdb597c38fbc97e719e4752244c8b0dcd290cec7293b3f4f6bc2e697",
                "md5": "3352349d41067b0b173a86f06d7925dc",
                "sha256": "40e2ef8a4a2ac6b551567f514e006e1970510e70394ae8826c25fa1c484757f3"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vocabbench/MAL-2026-18173.json"