Malicious Code Vulnerability in Acoustichub Package - Remote Script Execution Risk
Summary
MAL-2026-18155: Malicious code in acoustichub (PyPI). Affects acoustichub versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Acoustichub is a package available on PyPI that is designed for voice synthesis profiles. It allows users to integrate voice synthesis capabilities into their applications. However, this package has been identified as part of a malicious campaign that enables the execution of remote scripts, posing significant security risks to users who install it.
Vulnerability Detail
The vulnerability stems from a coordinated campaign that involves loader packages like Acoustichub, which are designed to execute code from a specified URL. Although the package itself does not contain the malicious payload, it serves as a vector for downloading and executing harmful scripts. This can lead to severe consequences, including data theft and unauthorized access to systems. The malicious intent is clear, as it falls under the category of infostealers, which are designed to extract sensitive information from users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall acoustichubIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can implement network security measures to block requests to known malicious URLs. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The Acoustichub package has been identified as part of a malicious campaign that poses significant risks to users by enabling remote script execution. Users are advised to uninstall the package and monitor for any updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for acoustichub →
FAQ
Acoustichub is a package on PyPI designed for voice synthesis, allowing integration of voice capabilities into applications.
The vulnerability allows the Acoustichub package to download and execute remote malicious scripts, posing security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Uninstall the Acoustichub package immediately using pip uninstall acoustichub to mitigate the risk.
Yes, consider using other voice synthesis libraries that do not have known vulnerabilities.
