Malicious Code Injection in Vellutts Package - PyPI Vulnerability
Summary
MAL-2026-18149: Malicious code in vellutts (PyPI). Affects vellutts versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vellutts is a Python package available on the Python Package Index (PyPI) that is designed for voice synthesis profiles. It allows users to integrate voice synthesis capabilities into their applications. However, the package has been identified as part of a coordinated campaign that facilitates the execution of malicious code from remote sources, posing significant security risks to users.
Vulnerability Detail
The vulnerability in the Vellutts package stems from its ability to download and execute remote scripts, which can lead to the execution of malicious payloads on the user's system. This behavior is indicative of a broader campaign involving multiple deceptive packages designed to load harmful code. The malicious intent is clear, as it can lead to data theft, unauthorized access, and other forms of exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall velluttsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the Vellutts package until a secure version is released. You can also consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The Vellutts package has been identified as part of a malicious campaign that poses significant security risks due to its ability to execute remote scripts. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source software effectively.
See every vulnerability recorded for vellutts →
FAQ
Vellutts is a Python package designed for voice synthesis, allowing developers to integrate voice capabilities into their applications.
The Vellutts package contains a vulnerability that allows it to download and execute malicious scripts from remote locations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have the Vellutts package installed, it is recommended to uninstall it immediately and monitor for any updates or patches.
Vulert monitors and alerts users in real-time for open-source vulnerabilities in software by analyzing the Pipfile.lock, ensuring that developers are informed of potential risks.
