Malicious Code Injection in phonoviatts Package - PyPI Vulnerability
Summary
MAL-2026-18143: Malicious code in phonoviatts (PyPI). Affects phonoviatts versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The phonoviatts package is a Python library available on the Python Package Index (PyPI) that is likely intended for voice synthesis or related functionalities. However, it has been identified as part of a malicious campaign that enables the execution of remote scripts, posing significant security risks to users and their systems.
Vulnerability Detail
The vulnerability stems from a coordinated campaign involving loader packages that execute code from a specified URL. Although the phonoviatts package does not contain the malicious payload itself, it serves as a vector for downloading and executing potentially harmful scripts. This poses a risk of data theft and system compromise, as the executed scripts can perform unauthorized actions on the user's machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall phonoviattsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the phonoviatts package altogether and look for alternative libraries that provide similar functionality without the associated risks. Additionally, implementing network security measures to block unauthorized script execution can help mitigate the threat.
Conclusion
The phonoviatts package has been identified as part of a malicious campaign that poses significant security risks. Users are advised to uninstall the package and monitor for updates or alternatives to ensure their systems remain secure.
See every vulnerability recorded for phonoviatts →
FAQ
phonoviatts is a Python library available on PyPI, likely intended for voice synthesis or related functionalities.
The vulnerability allows for the execution of remote malicious scripts, which can lead to data theft and unauthorized access to your system.
You should uninstall the phonoviatts package immediately and refrain from using any versions associated with this vulnerability.
Yes, consider using other voice synthesis libraries that do not have known vulnerabilities.
You can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
