MalwarePublished 21 Oct 2026Updated 29 Oct 2026

dictanovaasr (PyPI) · Malicious Code

Affects dictanovaasrSource GCVE Database

Malicious package : remove dictanovaasr and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 17:52 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-18139

What to do

Remove dictanovaasr from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIdictanovaasr	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The dictanovaasr package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. Although the examined package showed no direct evidence of exfiltration, credential harvesting, or backdoors, it is designed to execute code from external URLs, indicating a coordinated effort to distribute malicious payloads.

Impact

The package enables execution of remote malicious scripts, which can lead to arbitrary code execution on the host system. This behavior poses a risk of malware infection, potentially including infostealers or other harmful payloads, depending on the remote script delivered. No direct evidence of exploitation or credential theft was observed in the analyzed version, but the capability to load external code is inherently dangerous.

Defensive guidance

Users should avoid installing or using dictanovaasr version 0.1.0 from PyPI. Verify dependencies and sources before installation to prevent inclusion of such loader packages.

Summary

The dictanovaasr PyPI package version 0.1.0 has been identified as part of a malicious campaign named '2026-10-voice-synthesis-profiles'. This campaign uses loader packages that do not contain the payload themselves but fetch and execute remote malicious scripts. An analysis of dictanovaasr 0.1.0 found no direct signs of exfiltration, install-time or import-time code execution from external sources, or other suspicious behaviors during installation. However, the package's capability to download and run remote code classifies it as malicious and part of a coordinated campaign to deliver malware.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 17:52 UTC

Technical details

References

Community reviews