Malicious code in quasitonnts (PyPI)

The quasitonnts package (version 0.1.0) on PyPI is part of a malicious campaign that distributes packages under false pretenses, claiming to provide audio-analysis profiles. Instead, the package's actual purpose is to download and execute remote malicious scripts. This campaign is likely a continuation of a previous coin-mining campaign identified as 2026-10-voxeval, sharing similar deceptive wording. The package does not embed the malicious URL directly but fetches it at runtime, enabling remote code execution. There is no indication of known exploits in the wild or a vendor patch.

Users who install and run the quasitonnts package version 0.1.0 risk executing remote malicious code, which could lead to unauthorized system compromise, including potential coin-mining or other malicious activities. The package's deceptive nature increases the risk of inadvertent installation.

No official patch or remediation is indicated. Users should avoid installing the quasitonnts package version 0.1.0 from PyPI. Security teams should monitor for and block this package in their environments. Since the package fetches remote code, network controls to restrict unauthorized outbound connections may help mitigate risk.