Malicious code in kestreljob (PyPI)

The kestreljob package (version 0.1.0) is identified as part of a coordinated malicious campaign that distributes loader packages capable of executing code fetched from remote URLs. Although the package itself does not embed the malicious payload, it facilitates the execution of remote malicious scripts, indicating clear malicious intent. This campaign, named '2026-10-voice-synthesis-profiles', uses multiple similar packages to deploy deceptive loaders for malicious code execution.

The impact involves the execution of remote malicious scripts, which can lead to unauthorized code execution on systems where the package is installed. This can potentially result in further compromise depending on the payload delivered by the remote script. The package acts as a loader, making it a vector for delivering various malicious payloads.

No official patch or remediation is indicated. Users should avoid installing or using the kestreljob package version 0.1.0 from PyPI. It is recommended to verify the integrity and source of packages before installation and to monitor for updates or advisories from PyPI or security vendors regarding this package.