Malicious code in thornqueue (PyPI)

The thornqueue package (version 0.1.0) is involved in a malicious campaign identified as '2026-10-voice-synthesis-profiles'. It acts as a loader that downloads and executes remote malicious scripts, although it does not contain the payload directly. This campaign includes multiple similar packages designed to facilitate the execution of malicious code from given URLs, indicating a coordinated effort to distribute malware through deceptive loader packages on PyPI.

The primary impact is the potential execution of remote malicious code on systems that install and run the thornqueue package version 0.1.0. This could lead to compromise of the affected systems depending on the nature of the downloaded payload. Since the package itself does not contain the payload, the exact impact depends on the remote script executed, but the intent is clearly malicious.

No official patch or remediation is indicated. Users should avoid installing thornqueue version 0.1.0 from PyPI. Security teams should block or monitor for this package and similar loader packages associated with the '2026-10-voice-synthesis-profiles' campaign. Verify package integrity and source before installation to prevent execution of remote malicious code.