Malicious Code Injection in Speechprobe Package - PyPI Vulnerability
Summary
MAL-2026-18168: Malicious code in speechprobe (PyPI). Affects speechprobe versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Speechprobe is a Python package available on the Python Package Index (PyPI) that is designed for voice synthesis and related functionalities. It allows developers to integrate speech processing capabilities into their applications. However, the package has been identified as part of a coordinated campaign that includes malicious loaders, which can execute remote scripts, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2026-10-voice-synthesis-profiles'. The speechprobe package has been found to download and execute a remote malicious script, which can lead to unauthorized access, data theft, or further exploitation of the affected systems. The malicious code does not reside within the package itself but is executed from a URL, making it difficult to detect and mitigate without proper monitoring.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall speechprobeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the speechprobe package until a secure version is released. Additionally, implement network security measures to block any unauthorized script execution from unknown URLs.
Conclusion
The speechprobe package has been identified as part of a malicious campaign that can execute harmful scripts remotely. Users are urged to update their packages and monitor their systems closely. Utilizing tools like Vulert can enhance security by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for speechprobe →
FAQ
The vulnerability allows the execution of remote malicious scripts, which can compromise user systems.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Immediately update the package to the latest version using 'pip install --upgrade speechprobe' and monitor your systems for any unusual activity.
While specific exploits have not been detailed, the nature of the vulnerability suggests potential for data theft and unauthorized access.
Vulert monitors and alerts users in real-time for open-source vulnerabilities in their software by analyzing the Pipfile.lock, ensuring timely awareness of security issues.
