I'm a Cyber Security researcher and developer of PackjGuard [1] to address open-source software supply chain attacks.

Issue

During my research, I found that this repo is vulnerable to attack due to deleted dependency from the public PyPI registry.

Details

Specifically, file https://github.com/Pogayo/african-voices-web/blob/430339145f6f7d1fddddb656ec7e5e297f15b94d/requirements.txt lists click8 as one of the dependencies. However, it has been deleted from public PyPI. As such, an external bad actor can claim that name and register a malicious package, which will be then installed with pip install command, resulting in arbitrary remote code execution.

Impact

Not only your apps/services using https://github.com/Pogayo/african-voices-web repo code are vulnerable to this attack, but the users of your open-source Github repo could also fall victim.

You could read more about such attacks here: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Remediation

Please manually register a placeholder click8 package on PyPI immediately or remove click8 dependency from https://github.com/Pogayo/african-voices-web/blob/430339145f6f7d1fddddb656ec7e5e297f15b94d/requirements.txt to fix this vulnerability.

To automatically fix such issues in future, please install PackjGuard Github app [1].

Thanks!

1. PackjGuard is a Github app that monitors your repos 24x7, detects vulnerable/malicious/risky open-source dependencies, and creates pull requests for auto remediation: https://github.com/marketplace/packjguard

Hello, I am trying to generate voices using curl as described in your developer guidelines. The command is returning a .wav file with the target sentence, but the accent is from an American speaker (not the target language). Here is an example to reproduce the error in Swahili:

fname=$(curl -e -H  -X  POST -F 'synth_id=swa_wak_30' -F \
                    'text=habari ya leo' -F 'audio_format=wav' https://www.africanvoices.tech/language/swa \
                    | grep synth-audio \
                    | sed -e 's/.*src="\(.*\)wav.*/\1/')

curl https://www.africanvoices.tech"$fname"wav --output out.wav

If I use the GUI on the site, it sounds fine and matches the samples on the Swahili page, so I think this is an error specifically with curl access failing to pass the synth_id through somewhere.

Thanks for any guidance you can offer!