MAL-2026-18231

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/loadferry/MAL-2026-18231.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18231
Published
2026-10-23T16:03:15Z
Modified
2026-10-29T14:45:08Z
Summary
Malicious code in loadferry (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ddac804a8e64115b31c6c4a2e45417f7c283c358cf80f9a76391118861512d85)

Analysis of loadferry 0.1.0 on PyPI surfaced no indicators of installer harm. No install-time or import-time network activity, credential or environment scraping, filesystem persistence, lifecycle-hook execution, obfuscated payloads, or outbound beacons were observed in the shipped files.

Source: kam193 (6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/loadferry",
            "import_time": "2026-10-23T16:20:13.981456224Z",
            "modified_time": "2026-10-23T16:03:15.659728Z",
            "sha256": "6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022323",
            "import_time": "2026-10-29T14:37:03.898867793Z",
            "modified_time": "2026-10-29T14:17:50Z",
            "sha256": "ddac804a8e64115b31c6c4a2e45417f7c283c358cf80f9a76391118861512d85",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / loadferry

Package

Name
loadferry
View open source insights on deps.dev
Purl
pkg:pypi/loadferry

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "loadferry-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "69e9aefbd52567fd4c4d23cbb0cf22c27728e36f297f92211b6fcd3c00d0f6c6",
                "md5": "cd97d7f9fb85f3673387177e9e3b4f35",
                "sha256": "6e2b241b45e5d66dc73e1256de259a348a3886cd975a0dd713f2714ecf9f1213"
            }
        },
        {
            "filename": "loadferry-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "9a69324880b9af2290f8b4ef6d2e3600b25c0709e0698d5050d2c40962ca8f11",
                "md5": "9340decaf7ca6019aa52968144514743",
                "sha256": "58b036272e30f71ff95449537bd76bbdbd8a1da624ef5a22c6db483a3fee7529"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/loadferry/MAL-2026-18231.json"