MAL-2026-18161

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d0ca7b14989e601c74369996f80d2c6b6bd68200997d3a0368ba00652ade2799) Package evalstream 0.1.0 on PyPI was examined and no install-time or import-time behavior indicative of a supply-chain attack was observed. There is no evidence of credential or environment scraping, outbound network beacons to attacker-controlled destinations, remote code fetch-and-execute, lifecycle or build-backend code execution with external network I/O, or persistent/backdoor mechanisms. No third-party credentials, registry-redirecting configuration, or dependency-dropper patterns are present. ## Source: kam193 (00f8be270be4392f91ab130c7e77583408a4e24e858b22522158a61116c0a0d4) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script.