Malicious code in glassbeakasr (PyPI)

The 'glassbeakasr' package on PyPI, specifically version 0.1.0, is a malicious package that masquerades as an audio-analysis profile loader but is designed to download and execute remote malicious code. It is linked to the '2026-10-emberlytts' campaign and appears to be a continuation of the '2026-10-voxeval' coin-mining campaign. The package does not embed the malicious URL directly, suggesting dynamic retrieval of the payload. This behavior classifies it as a malicious package rather than a vulnerability in the software itself.

Users who install the 'glassbeakasr' package version 0.1.0 risk execution of remote malicious scripts, which could lead to compromise of the host system. The malicious code could perform unauthorized actions such as data theft or resource abuse. There are no known exploits in the wild reported yet, but the intent is clearly malicious.

Avoid installing the 'glassbeakasr' package version 0.1.0 from PyPI. Remove any existing installations of this package. Since this is a malicious package rather than a software vulnerability, no patch is available. Users should rely on trusted sources and verify package authenticity before installation.