Malicious code in emberlytts (PyPI)

The emberlytts package (version 0.1.0) is identified as a malicious package on PyPI that pretends to provide audio-analysis functionality but instead downloads and executes remote malicious scripts. It is likely a continuation of a previous coin-mining campaign known as 2026-10-voxeval, sharing similar deceptive wording. The package does not embed the malicious URL directly but relies on remote code execution. There is no CVSS score available, and no known exploits in the wild have been reported.

The package enables remote code execution by downloading and running malicious scripts, which can lead to compromise of systems where it is installed. This can facilitate unauthorized actions such as data theft, system manipulation, or further malware deployment. The malicious intent is clear, though no active exploitation has been documented yet.

Users should avoid installing the emberlytts package, especially version 0.1.0. Remove any installations of this package from environments. Since no official patch or fix is available, the best mitigation is to block or uninstall the malicious package and monitor for any signs of compromise related to its use.