aurenatts

{"schema_version":"1.7.4","id":"MAL-2026-18134","published":"2026-10-21T23:05:04Z","modified":"2026-10-29T14:38:27.524889255Z","summary":"Malicious code in aurenatts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5869d16450da25408cefa75ae7be59ed27dd99952bf7161b655f6be6289dcaa5)\nNo evidence of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or self-propagation was observed in this package version. No lifecycle hooks, outbound network calls to attacker-controlled destinations, credential-path reads, or obfuscated payloads were identified in the scanned files.\n\n## Source: kam193 (ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - other\n","affected":[{"package":{"name":"aurenatts","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"aurenatts-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"dc9e26680653f0c46eb1f3c1b58bddec303587f765791e360cd6174afe61a5f4","md5":"09c56068d3b148f7b766ee6ade0c88b6","sha256":"61fbf88710acae85248d528c7b95da39d37557274e997812c0366fe3067a7768"}},{"filename":"aurenatts-0.1.0.tar.gz","hashes":{"blake2b_256":"ad76b1ae9394b1cf2aaa56d2d02ebf80bb8808e597c4d6f9e86fbb291840ef48","md5":"39529b6137f5034603ab6dc0c3536af4","sha256":"46d6c2b1cd8e3bf8b59d6c391d2fef7d28fdb902954f41a9ba0b164f5da7a9a1"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/aurenatts"},{"type":"PACKAGE","url":"https://pypi.org/project/aurenatts/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/aurenatts","import_time":"2026-10-21T23:40:12.28077286Z","modified_time":"2026-10-21T23:05:04.68036Z","sha256":"ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/aurenatts","import_time":"2026-10-22T01:26:38.718311641Z","modified_time":"2026-10-21T23:05:04.68036Z","sha256":"a3052703bacca34c4cd832902d3cab0ed1bfb063fdcbe39daa61373899edfc4d","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/aurenatts","import_time":"2026-10-29T14:14:43.199732171Z","modified_time":"2026-10-21T23:05:04.68036Z","sha256":"bc65b00b5c1df2a3b536f65d1d47b8515ba4a15006b1eeb681761d7fd523d722","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022370","import_time":"2026-10-29T14:37:06.079335777Z","modified_time":"2026-10-29T14:24:04Z","sha256":"5869d16450da25408cefa75ae7be59ed27dd99952bf7161b655f6be6289dcaa5","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}