MalwarePublished 21 Oct 2026Updated 29 Oct 2026

aurenatts (PyPI) · Malicious Code

Affects aurenattsSource GCVE Database

Malicious package : remove aurenatts and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18134

What to do

Remove aurenatts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIaurenatts	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'aurenatts' version 0.1.0 is part of a malicious campaign involving loader packages designed to execute code from remote URLs. Although this specific package version does not show evidence of direct exfiltration, remote code execution at install time, or other common malicious behaviors, it functions as a loader that downloads and executes remote malicious scripts. This activity indicates a coordinated effort to distribute malicious code through deceptive means.

Impact

The package enables execution of remote malicious scripts, which can lead to compromise of systems where it is installed. Although no direct evidence of exploitation or payload delivery within the package itself was found, the capability to execute remote code poses a significant risk of malware infection or further malicious activity initiated by the downloaded scripts.

Defensive guidance

Users should avoid installing or using the 'aurenatts' package version 0.1.0 from PyPI. Monitor for updates from the package maintainers or PyPI security advisories for any changes or removals related to this package.

Summary

The 'aurenatts' package on PyPI, version 0.1.0, is identified as part of a malicious campaign named '2026-10-voice-synthesis-profiles'. The package itself does not contain a direct malicious payload or lifecycle hooks but serves as a loader that downloads and executes code from a remote URL. Scans found no evidence of exfiltration, credential theft, backdoors, or obfuscated payloads within the package files. However, the campaign's intent is clearly malicious, aiming to provide multiple deceptive methods to load malicious code remotely.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:52 UTC

Technical details

References

Community reviews