---
id: "MAL-2026-17461"
kind: "package"
aliases: ["MAL-2026-17461"]
title: "Malicious code in voxel-tts (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "voxel-tts", "fixed": [], "affected": "= 0.5.0; = 0.5.1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-03T04:38:14+00:00"
first_seen_at: "2026-10-26T20:51:58+00:00"
updated_at: "2026-10-26T21:08:21+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-17461", "first_seen_at": "2026-10-26T20:51:58+00:00"}]
---

# Malicious code in voxel-tts (PyPI)

## Affected

- pypi:voxel-tts affected = 0.5.0; = 0.5.1 fixed ?

## Timeline

- 2026-10-26T20:51:58+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-17461

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5)
The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxel_tts loads voxel_tts/harness.py, which instantiates a module-level Harness(); on run() it chmods and executes a bundled ~8MB ELF at voxel_tts/bin/voxel-core. The ELF is invoked with a JSON configuration matching the XMRig-family CPU mining schema (pools/user/pass/keepalive/tls, cpu.threads, cpu.mem-locked, cache-budget), and the pool-protocol key 'pools' is split across string concatenation to evade static scanners. The pool destination is reconstructed at runtime by base64-decoding two fragments ('MTg1LjE5NA==', 'MTc3LjI0OQ==') and joining them with '.', yielding 185.194.177.249:443. A 40MB cloudflared binary is also bundled at voxel_tts/bin/cloudflared and launched as 'cloudflared access tcp --hostname <host> --url 127.0.0.1:<port>' so that outbound mining traffic egresses through Cloudflare Access to an author-controlled hostname, hiding the real pool IP from host network logs; in-code comments acknowledge this is to avoid 'direct egress to the coordinator's own address'. In parallel, a _Progress helper emits synthetic 'model | step N/250000 loss=... tok/s=... lr=6e-5 ep=...' lines once per minute as a cover story to make the workload appear to be ML training. Net effect: installing and using this package runs a cryptominer on the installer's CPU, monetizing their compute for the author, while actively evading detection via destination obfuscation, tunneled egress, and a fabricated training-progress UI.

## Source: kam193 (59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d)
The package imitates real activity and instead deploys a coin miner.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-voxeval


Reasons (based on the campaign):


 - cryptominer

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_