quasitonnts

{"schema_version":"1.7.4","id":"MAL-2026-17917","published":"2026-10-17T17:03:49Z","modified":"2026-10-29T14:38:27.740991884Z","summary":"Malicious code in quasitonnts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85125cc2bc8e39e151e11ee36382b5d2e2167dfb215e654ade236e46b783b062)\nPackage quasitonnts version 0.1.0 on PyPI was examined and no code paths performing credential access, outbound network I/O to attacker-controlled destinations, install-time or import-time code execution, dropper behavior, or persistence were identified in its shipped files.\n\n## Source: kam193 (6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540)\nThe package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-emberlytts\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"quasitonnts","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"quasitonnts-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"a43465ee2f4ef297cc22b1c5d9908ce1b3072bd3c4b146a8ff14936f9ae841b1","md5":"ea55a6d56dee13bbb130221be2b03339","sha256":"ab023f868f0cc80263a714626b0f81650baf58f5aba03f59d9b07212eaaa1e25"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/quasitonnts"},{"type":"PACKAGE","url":"https://pypi.org/project/quasitonnts/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-emberlytts/quasitonnts","import_time":"2026-10-17T17:38:26.304725086Z","modified_time":"2026-10-17T17:03:49.238038Z","sha256":"6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022346","import_time":"2026-10-29T14:37:05.131625423Z","modified_time":"2026-10-29T14:20:57Z","sha256":"85125cc2bc8e39e151e11ee36382b5d2e2167dfb215e654ade236e46b783b062","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}