Malicious Code Injection in audiokit: A PyPI Vulnerability
Summary
MAL-2026-18158: Malicious code in audiokit (PyPI). Affects audiokit versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
audiokit is a Python package available on the Python Package Index (PyPI) designed for audio processing and manipulation. It provides various functionalities for audio synthesis, playback, and analysis, making it a valuable tool for developers working on audio-related projects. However, recent findings have revealed that certain versions of audiokit are part of a coordinated campaign that allows the execution of malicious code from remote sources, posing significant security risks to users.
Vulnerability Detail
The vulnerability stems from a malicious campaign identified as '2026-10-voice-synthesis-profiles', where the audiokit package has been compromised to include a loader that downloads and executes a remote malicious script. This poses a severe threat as it can lead to unauthorized access, data theft, or further exploitation of the user's system. The malicious code is executed without the user's consent, making it a clear case of malicious intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall audiokitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the audiokit package until a secure version is confirmed. Additionally, consider implementing network security measures to block unauthorized script executions from unknown sources.
Conclusion
The audiokit package has been identified as part of a malicious campaign that poses significant security risks due to its ability to execute remote scripts. Users are strongly advised to update their packages and monitor their dependencies for vulnerabilities to ensure the security of their applications.
See every vulnerability recorded for audiokit →
FAQ
The vulnerability allows for the execution of malicious code from a remote server, which can compromise user systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package, consider implementing security measures to prevent unauthorized script execution and avoid using the package until it is confirmed safe.
Detailed information about the vulnerability can be found on the GitHub repository of malicious packages or by following security advisories related to PyPI.
Yes, Vulert provides a service that monitors open-source vulnerabilities in your software using just the Pipfile.lock, allowing for real-time alerts.
