Malicious PyPI package zennittts 0.1.0 (loader campaign)

published 2026-10-21

Version 0.1.0 of the zennittts PyPI package is part of a coordinated campaign of loader packages that run code fetched from a web address. The payload is not in the package and its use is unknown, but the source rates the campaign as clearly malicious.

Source: OSV

Get the fix

Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 1199 and your operating system.