{"id":"MAL-2026-17917","kind":"package","aliases":["MAL-2026-17917"],"related":[],"title":"Malicious code in quasitonnts (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540)\nThe package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-emberlytts\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"quasitonnts","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-17T17:03:49+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':73C,91C '-17917':8A,11A '-2026':7A,10A '2026':72C,90C '6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540':26C 'advertis':36C 'analysi':39C 'audio':38C 'audio-analysi':37C 'base':94C 'belong':29C 'campaign':71C,82C,89C,97C 'categori':79C 'clear':84C 'code':2A,51C 'coin':69C 'coin-min':68C 'continu':65C 'detail':17C 'download':99C 'edit':20C 'embed':57C 'emberlytt':92C 'execut':49C,101C 'fact':43C 'fals':35C 'infosteal':88C 'intent':86C 'kam193':25C 'like':63C,87C 'line':23C 'loader':41C 'mal':6A,9A 'malici':1A,13B,80C,85C,104C 'mine':70C 'packag':14B,28C,34C,60C 'per':15C 'profil':40C 'purpos':46C 'pypi':5A 'quasitonnt':4A 'quasitonnts':12A 'reason':93C 'remot':50C,103C 'script':105C 'seri':32C 'similar':77C 'sourc':16C,24C 'url':54C 'use':76C 'voxev':74C 'word':78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T17:03:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17917","url":"https://osv.dev/vulnerability/MAL-2026-17917","severity":"critical","published_at":"2026-10-17T17:03:49+00:00","modified_at":"2026-10-17T17:45:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}