Malicious code in novalithtts (PyPI)

The 'novalithtts' package on PyPI, specifically version 0.1.0, is identified as malicious software masquerading as an audio-analysis tool. Its actual purpose is to download and execute remote malicious scripts, enabling remote code execution. This behavior aligns with a known coin-mining campaign (2026-10-voxeval) that used similar tactics and wording. The package does not embed the malicious URL internally, suggesting dynamic retrieval of the payload. This constitutes a supply chain threat through a malicious package upload.

Systems that install or run the 'novalithtts' package version 0.1.0 may execute remote malicious code, potentially leading to unauthorized system control, resource abuse (such as cryptocurrency mining), or further compromise. The malicious code execution can undermine system integrity and confidentiality. No known exploits in the wild have been reported yet.

Users should immediately avoid installing or remove the 'novalithtts' package version 0.1.0 from their environments. Since no patch or fix is available, the best mitigation is to block or blacklist this package and monitor for its presence in software supply chains. Verify package authenticity before installation and use trusted sources. No vendor advisory or official fix is available; patch status is not yet confirmed.