Malicious Code Vulnerability in asrloom Package - Remote Script Execution Risk
Summary
MAL-2026-18157: Malicious code in asrloom (PyPI). Affects asrloom versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The asrloom package, available on PyPI, is designed for voice synthesis profiles. It allows users to create and manage voice synthesis configurations. However, it has been identified as part of a coordinated campaign that includes malicious loader packages capable of executing code from external URLs, posing significant security risks.
Vulnerability Detail
The vulnerability originates from a coordinated campaign identified by the source kam193, which involves loader packages that execute remote scripts. The asrloom package does not contain the malicious payload itself but serves as a vector for executing potentially harmful code from a specified URL. This can lead to severe consequences, including unauthorized access to sensitive data and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall asrloomIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the asrloom package until a secure version is released. Additionally, consider implementing network security measures to block requests to untrusted URLs.
Conclusion
The asrloom package has been identified as part of a malicious campaign that poses significant security risks through remote script execution. It is crucial to update the package to a secure version and implement necessary workarounds to mitigate potential threats.
See every vulnerability recorded for asrloom →
FAQ
The asrloom package is used for managing voice synthesis profiles, allowing users to create and configure voice synthesis settings.
This vulnerability can allow attackers to execute malicious scripts on your system, potentially leading to data breaches and unauthorized access.
Check the official PyPI repository for the asrloom package to see if a patched version has been released.
Implement network security measures to block access to untrusted URLs and refrain from using the package until it is updated.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires no installation and uses Pipfile.lock for real-time monitoring.
