gtts-lts

GHSA-325w-hx62-r6xf

Malicious code in gtts-lts (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2.5.8`

## Source: kam193 (7cfb789704a149f7b741d0c68fcb8a32a1e189444ca36f97e435e59d04e073b8)
During the execution, the package silently download and runs a JAR not related to the package job. At the time of analysis, the content was corrupted


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-09-gtts-lts


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - action-hidden-in-lib-usage

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/gtts-lts/MAL-2025-191745.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/gtts-lts
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/gtts-lts/MAL-2025-191745.json
- https://github.com/advisories/GHSA-325w-hx62-r6xf

Compromised versions (1)

= 2.5.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.