melcuratts

{"schema_version":"1.7.4","id":"MAL-2026-18141","published":"2026-10-21T23:04:07Z","modified":"2026-10-29T14:38:27.664555742Z","summary":"Malicious code in melcuratts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (01116dad2488eeeb0e57fc2ae314e507b8cb8aad04245f54ddb89eb2f019441e)\nmelcuratts 0.1.0 contains no observed install-time or import-time execution of attacker-controlled code, no credential or environment harvesting, no outbound network to attacker-controlled destinations, no silent relay of caller-supplied data, no persistence or backdoor mechanism, and no shipped third-party credentials. No supply-chain attack fingerprint is present in the package contents.\n\n## Source: kam193 (8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - other\n","affected":[{"package":{"name":"melcuratts","ecosystem":"PyPI"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"melcuratts-0.1.0-py3-none-any.whl","hashes":{"blake2b_256":"ebb1a26d43c5dbef1b72eca2f82f5225d10c7c70eb574bf4f75bf77a4a97dc43","md5":"fdc88f6bcee0b17c6eb6fb27e2817fb3","sha256":"f9316c2509a57d086c4ceae2ac998e459ea5932828c2744e7c7f62d9798d896f"}},{"filename":"melcuratts-0.1.0.tar.gz","hashes":{"blake2b_256":"15968fc82d285e100b2c2ffc4ce7426b939dde3742eb7be8b2faf308ef8431ec","md5":"4eaf468b986614a36b805dfd0f14f8b2","sha256":"77e7c648910d26ccb4e78cff7bd6b80f38b04116067ef4a5b76fdb21876daabf"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/melcuratts"},{"type":"PACKAGE","url":"https://pypi.org/project/melcuratts/0.1.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/melcuratts","import_time":"2026-10-21T23:40:12.297666449Z","modified_time":"2026-10-21T23:04:07.625607Z","sha256":"8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/melcuratts","import_time":"2026-10-22T01:26:38.726290636Z","modified_time":"2026-10-21T23:04:07.625607Z","sha256":"e2e2a02871e4991844ba9a7bdf2f7416f0a228d615224074c8b96ddfaebad00f","source":"kam193","versions":["0.1.0"]},{"id":"pypi/2026-10-voice-synthesis-profiles/melcuratts","import_time":"2026-10-29T14:14:43.209337882Z","modified_time":"2026-10-21T23:04:07.625607Z","sha256":"eb7dfa510fdbee16e2a104218ddb5aba14cfadef729ba9054431360592df3bc5","source":"kam193","versions":["0.1.0"]},{"id":"IN-MAL-2026-022362","import_time":"2026-10-29T14:37:05.773738926Z","modified_time":"2026-10-29T14:23:05Z","sha256":"01116dad2488eeeb0e57fc2ae314e507b8cb8aad04245f54ddb89eb2f019441e","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}