glassbeakasr

{"schema_version":"1.7.4","id":"MAL-2026-17914","published":"2026-10-17T17:04:38Z","modified":"2026-10-29T14:16:01.234382990Z","summary":"Malicious code in glassbeakasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (49081dd7d5152c882944c4e9a5f118e71daadc5efa3e71c96fbdffe0840dedb5)\nThe package exposes a run(profile, url, **kwargs) function that fetches a caller-supplied URL and executes the response body as Python via exec(compile(src, url, 'exec'), mod.__dict__). The URL is not hardcoded, there are no install-time or import-time hooks, no top-level network I/O, and no reads of installer secrets or environment variables. The remote-code execution surface is only reached if a caller explicitly invokes run() with a URL they chose. This is an advertised dynamic-loader API rather than a covert dropper, but the design pattern is inherently hazardous: any caller passing an attacker-influenced URL would execute arbitrary Python in-process with no integrity or signature check.\n\n## Source: kam193 (de05a7ca1743ea6c3ceba4abc7f5452783d567b39f20007aeb57071a6d4019ed)\nThe package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-emberlytts\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"glassbeakasr","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"glassbeakasr/__init__.py","sha256":"8d44f0033ee2867d15d4d770d659b7718cf6ed885e90da7ccfb00c7e8b7b320d","tlsh":"cc31621bcd0c723396d1b814a2d466bae32b641b3601c9b0794c92292f87d36c1f1507"}],"package_integrity":[{"filename":"glassbeakasr-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"679becda970ee69b7f3c837fd2ff8d217c7ff2af7651f3aca2e63e02a3782ae4","md5":"6f668f556373e96a96ac4e2843914ff3","sha256":"e8e8efe38a4603cc1673d379b72bf532fd59ce41d3ab08e44ac413d6f9bfa118"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/glassbeakasr"},{"type":"PACKAGE","url":"https://pypi.org/project/glassbeakasr/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-emberlytts/glassbeakasr","import_time":"2026-10-17T17:38:26.302416733Z","modified_time":"2026-10-17T17:04:38.893439Z","sha256":"de05a7ca1743ea6c3ceba4abc7f5452783d567b39f20007aeb57071a6d4019ed","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022086","import_time":"2026-10-29T14:14:24.564649272Z","modified_time":"2026-10-29T13:46:57Z","sha256":"49081dd7d5152c882944c4e9a5f118e71daadc5efa3e71c96fbdffe0840dedb5","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}