Malicious Code Vulnerability in Orchestril Package - PyPI
Summary
MAL-2026-18142: Malicious code in orchestril (PyPI). Affects orchestril versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Orchestril is a package available on the Python Package Index (PyPI) that is designed for orchestrating various tasks in Python applications. It allows developers to streamline their workflows by providing utilities for task management and execution. However, recent findings have revealed that Orchestril is part of a coordinated campaign that includes malicious loaders capable of executing remote scripts, posing significant security risks to users.
Vulnerability Detail
The vulnerability in the Orchestril package stems from its ability to download and execute remote scripts from a specified URL. This behavior is indicative of a malicious campaign aimed at distributing harmful payloads, such as infostealers. The specific version affected is 0.1.0, which has been identified as part of a broader campaign targeting voice synthesis profiles. Users of this package may unknowingly expose their systems to remote code execution attacks, leading to potential data breaches and system compromises.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall orchestrilIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the Orchestril package until a secure version is released. Additionally, consider implementing network security measures to block unauthorized script execution from unknown URLs.
Conclusion
The Orchestril package has been identified as vulnerable to malicious code execution, posing significant risks to users. It is essential to stay informed about updates and to utilize tools like Vulert for monitoring vulnerabilities in open-source software. Users should take immediate action to mitigate risks associated with this vulnerability.
See every vulnerability recorded for orchestril →
FAQ
The vulnerability allows malicious code to be executed remotely, which can compromise user systems.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Immediately update the package to the latest version once a patch is released, and consider removing it until then.
Risks include unauthorized access to sensitive data, system compromise, and potential data breaches.
Vulert monitors and alerts users in real-time for open-source vulnerabilities using just the Pipfile.lock, ensuring that applications remain secure.
