If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a31d5b9e7319cd715f9cfcd79aecbc918ab308c3e52a9abf132b026f059ee62f)
Analysis of acoustichub 0.1.0 did not surface install-time execution hooks, outbound network behavior, credential or environment reads, or other patterns consistent with supply-chain attacks against installers.
Source: kam193 (8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34)
This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.