Malicious code in pyrechoasr (PyPI)

The pyrechoasr package version 0.1.0 on PyPI is part of a malicious campaign that distributes packages under the guise of audio-analysis tools. Instead of providing legitimate functionality, it downloads and executes remote malicious code. This behavior aligns with a prior coin-mining campaign named 2026-10-voxeval, indicating a continuation of similar malicious activity. The package does not embed the malicious URL directly but fetches it at runtime, facilitating remote code execution. There is no evidence of known exploits in the wild beyond the campaign context.

Users installing pyrechoasr version 0.1.0 risk remote code execution on their systems, potentially leading to unauthorized control, data theft, or use of system resources for malicious purposes such as coin mining. The malicious code execution can compromise system integrity and confidentiality.

Avoid installing the pyrechoasr package version 0.1.0 from PyPI. If already installed, remove the package immediately. Use trusted sources and verify package authenticity before installation. Monitor for any unusual system behavior indicative of compromise. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software.