Malicious Code Execution in quasitonnts Package - PyPI Vulnerability
Summary
MAL-2026-17917: Malicious code in quasitonnts (PyPI). Affects quasitonnts versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The quasitonnts package is part of a series of Python packages that falsely advertise functionality related to audio-analysis profiles. Instead of providing legitimate features, the package is designed to execute remote code, posing significant security risks to users. This malicious behavior is indicative of a broader campaign targeting unsuspecting developers and users in the Python ecosystem.
Vulnerability Detail
The vulnerability in the quasitonnts package arises from its malicious intent to download and execute a remote script without user consent. This behavior is part of a larger campaign identified as '2026-10-emberlytts', which has been linked to similar malicious activities in the past. The absence of an embedded URL in the package suggests that the execution of remote code is triggered by other means, potentially leading to unauthorized access, data theft, or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall quasitonntsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to avoid using the quasitonnts package altogether. If it has already been installed, users should remove it using the command: 'pip uninstall quasitonnts'. Additionally, consider using alternative packages that provide legitimate audio-analysis functionalities.
Conclusion
The quasitonnts package poses a significant security risk due to its malicious functionality, which allows for remote code execution. Users are strongly advised to uninstall the package and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source packages.
See every vulnerability recorded for quasitonnts →
FAQ
The quasitonnts package is a Python package that falsely claims to offer audio-analysis profiles but is actually designed to execute malicious code.
The vulnerability allows the package to download and execute remote scripts, potentially leading to unauthorized access and data theft.
If you have installed the quasitonnts package, you should uninstall it immediately using 'pip uninstall quasitonnts'.
Currently, there is no known safe version of the quasitonnts package. It is advisable to avoid using it altogether.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. With Vulert Playground, you can check if your application is affected by this vulnerability without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
