Malicious Code Vulnerability in grommatts Package
Summary
MAL-2026-18140: Malicious code in grommatts (PyPI). Affects grommatts versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grommatts package, available on PyPI, is designed for specific functionalities related to voice synthesis profiles. However, it has been identified as part of a coordinated campaign that allows for the execution of remote scripts, posing significant security risks to users. The package is intended for developers looking to implement voice synthesis features but has been compromised to potentially execute harmful code.
Vulnerability Detail
The vulnerability in the grommatts package arises from its ability to download and execute remote scripts from a specified URL. This behavior indicates malicious intent, as it can lead to the installation of infostealers or other harmful software on the user's system. The origin of this vulnerability is linked to a coordinated campaign by a source identified as kam193, which has released multiple loader packages with similar functionalities, all aimed at executing malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall grommattsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the grommatts package until a secure version is released. Additionally, consider using alternative packages that do not exhibit similar vulnerabilities.
Conclusion
The grommatts package has been identified as vulnerable to malicious code execution due to its ability to download and run remote scripts. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for grommatts →
FAQ
grommatts is a Python package available on PyPI, primarily used for functionalities related to voice synthesis profiles.
The grommatts package has been identified as part of a campaign that allows the execution of remote scripts, which can lead to the installation of harmful software.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If you have installed grommatts, it is recommended to uninstall the package immediately and monitor for any updates or patches.
Yes, consider exploring other packages that provide similar functionalities without the associated security risks.
