{"id":"MAL-2026-16203","kind":"package","aliases":["MAL-2026-16203"],"related":[],"title":"Malicious code in faiss-cpu-avx512 (PyPI)","description":"faiss-cpu-avx512@1.9.0 through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faiss_cpu_avx512/__init__.py _fetch_native() downloads an xz-compressed binary from https://files.catbox.moe/ (ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in 1.9.7), writes it to ~/.cache/faiss_cpu_avx512/bin/indexwrm with mode 0755 and runs it through subprocess.Popen(start_new_session=True), restarting it every 5 seconds for the life of the process. It triggers on a call to warmup() or start(); nothing runs on install or import, and the ARTIFACT_SHA256 constant is the string PENDING_BUILD so the advertised checksum check never executes. 1.9.0 to 1.9.3 reach the download only on hosts whose nvidia-smi reports compute capability 9 or 10; 1.9.4 onward download on every host and start one worker per GPU, and the code comments describe the binary as carrying a baked-in pool, wallet and relay and renaming its process to a vllm serve command line. We read all eight wheels between 2026-09-11 and 2026-09-14 and did not retrieve or run the binary.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"faiss-cpu-avx512","fixed":[],"affected":"= 1.9.0; = 1.9.1; = 1.9.2; = 1.9.3; = 1.9.4; = 1.9.5; = 1.9.6; = 1.9.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-14T00:00:00+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':193C,197C '-11':194C '-14':198C '-16203':11A,14A '-2026':10A,13A '/.cache/faiss_cpu_avx512/bin/indexwrm':72C '0755':75C '0oreqo.xz':57C '1.9.0':25C,54C,128C '1.9.3':56C,130C '1.9.4':59C,147C '1.9.5':62C '1.9.6':65C '1.9.7':27C,68C '10':146C '2026':192C,196C '3l3x0v.xz':63C '5':88C '9':144C 'advertis':123C 'artifact':113C 'avx512':7A,18A,24C 'avx512/__init__.py':41C 'bake':170C 'baked-in':169C 'binari':49C,165C,206C 'build':120C 'call':100C 'capabl':143C 'carri':167C 'check':125C 'checksum':124C 'code':2A,38C,161C 'command':184C 'comment':162C 'compress':48C 'comput':142C 'constant':115C 'cpu':6A,17A,23C,33C,40C 'describ':163C 'download':44C,133C,149C 'eight':189C 'everi':87C,151C 'execut':127C 'faiss':5A,16A,22C,32C,37C,39C 'faiss-cpu':31C 'faiss-cpu-avx512':4A,15A,21C 'fetch':42C 'ffoa50.xz':52C 'files.catbox.moe':51C 'gpu':158C 'host':136C,152C 'imperson':30C 'import':110C 'instal':108C 'life':92C 'line':185C 'mal':9A,12A 'malici':1A,19B 'mode':74C 'nativ':43C 'never':126C 'new':82C 'noth':105C 'nvidia':139C 'nvidia-smi':138C 'one':155C 'onward':148C 'packag':20B 'pend':119C 'per':157C 'pool':172C 'process':95C,179C 'pypi':8A,29C 'reach':131C 'read':187C 'relay':175C 'renam':177C 'report':141C 'restart':85C 'retriev':202C 'run':77C,106C,204C 'second':89C 'serv':183C 'session':83C 'sha256':114C 'ship':35C 'smi':140C 'start':81C,104C,154C 'string':118C 'subprocess.popen':80C 'trigger':97C 'true':84C 'vllm':182C 'vwfr94.xz':60C 'wallet':173C 'warmup':102C 'weu5u2.xz':66C 'wheel':190C 'whose':137C 'worker':156C 'write':69C 'xz':47C 'xz-compress':46C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-14T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16203","url":"https://osv.dev/vulnerability/MAL-2026-16203","severity":"critical","published_at":"2026-09-14T00:00:00+00:00","modified_at":"2026-09-16T01:30:07+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}