MAL-2026-18241 Malicious code in workslip (PyPI)

Analysis of workslip 0.1.0 on PyPI surfaced no a static rule matches and no traced behaviors indicative of supply-chain attack patterns. No install-time or import-time network I/O, no credential or filesystem harvesting, no obfuscated payloads, and no lifecycle hooks performing privileged or remote operations were observed in the shipped files.

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

• other

• Downloads and executes a remote malicious script.