Malicious Code Vulnerability in vocabblend Package
Summary
MAL-2026-18174: Malicious code in vocabblend (PyPI). Affects vocabblend versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vocabblend package, available on PyPI, is designed for voice synthesis profiles. It allows users to blend various voice attributes for enhanced audio outputs. However, this package has been identified as part of a coordinated campaign that potentially exposes users to malicious code execution from remote sources, raising significant security concerns.
Vulnerability Detail
The vulnerability stems from a malicious campaign identified by the source kam193, which involves loader packages that execute code from a specified URL. Although the vocabblend package itself does not contain the malicious payload, it is part of a broader scheme that aims to facilitate the loading of harmful scripts. This poses a risk of unauthorized access and data theft, as the executed scripts can perform various malicious actions without the user's consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall vocabblendIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users should avoid using the vocabblend package until a patched version is confirmed. Additionally, consider implementing network security measures to block requests to untrusted URLs.
Conclusion
The vocabblend package has been identified as part of a malicious campaign that poses significant security risks. Users are advised to update or uninstall the package and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for vocabblend →
FAQ
vocabblend is a Python package used for creating voice synthesis profiles, allowing users to blend different voice attributes for audio outputs.
The vulnerability allows for the execution of remote malicious scripts, which can compromise your application's security and lead to data theft or unauthorized access.
If you have installed vocabblend, it is recommended to uninstall it immediately and monitor your system for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Regularly update your packages, use tools like Vulert for monitoring vulnerabilities, and review package sources before installation.
