MAL-2026-17912 Malicious code in driftwavets (PyPI)

driftwavets 0.1.0 contains no observed install-time or import-time code paths that read installer secrets, fetch and execute remote content, relay caller data to a third-party destination, or establish persistence. No lifecycle hooks, build-backend network I/O,.pth side effects, or credential/env scraping were identified in the package contents.

The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-emberlytts

Reasons (based on the campaign):

• other

• Downloads and executes a remote malicious script.