{"id":"MAL-2026-17463","kind":"package","aliases":["MAL-2026-17463"],"related":[],"title":"Malicious code in voxcpmtts3 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5)\nThe package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload. voxcpmtts3/bin/voxcpm-core is XMRig (contains Monero/RandomX/CryptoNight/stratum/Hashrate/DONATE strings); harness.run() chmods it executable and spawns it via subprocess.Popen with a JSON config whose top-level key is assembled by string concatenation (\"po\"+\"ols\") to evade static analysis, carrying stratum-protocol fields (user/pass/keepalive/tls). A second bundled binary, voxcpmtts3/bin/cloudflared (~40MB), is launched with 'access tcp --hostname <edge> --url 127.0.0.1:<port>' to open a raw TCP tunnel through Cloudflare Access, hiding the real mining pool address behind a Cloudflare Access hostname and defeating destination-based blocking; a code comment acknowledges the design is to keep the traffic readable at the Cloudflare front door. In parallel, self._hb() POSTs run_id, state, Python tracebacks (up to 4000 chars) and timestamps to https://<edge>/hb through the same attacker-controlled Cloudflare Access hostname, giving the operator a per-victim telemetry channel that also leaks local filesystem paths from error traces. The 'TTS inference', 'coordinator', and 'step/loss/tok/s' terminology in code and README is cover for stratum mining pool concepts.\n\n## Source: kam193 (382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"voxcpmtts3","fixed":[],"affected":"= 0.1.0; = 0.1.1; = 0.1.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-03T04:47:46+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':238C '-17463':8A,11A '-2026':7A,10A '/hb':166C '127.0.0.1':106C '2026':237C '208e19':28C '382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d':214C '4000':161C '40mb':98C 'access':102C,115C,125C,174C 'acknowledg':136C 'activ':219C 'address':121C 'also':186C 'amazon':26C 'amazon-inspector':25C 'analysi':86C 'assembl':77C 'attack':171C 'attacker-control':170C 'b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5':29C 'base':131C,241C 'behind':122C 'binari':46C,96C 'block':132C 'bundl':45C,95C 'campaign':229C,236C,244C 'carri':87C 'categori':226C 'channel':184C 'char':162C 'chmod':59C 'clear':231C 'cloudflar':114C,124C,147C,173C 'code':2A,134C,202C 'coin':224C 'comment':135C 'concaten':80C 'concept':211C 'config':70C 'contain':55C 'control':172C 'coordin':197C 'cover':206C 'cryptojack':50C 'cryptomin':245C 'defeat':128C 'deploy':222C 'design':138C 'destin':130C 'destination-bas':129C 'detail':17C 'door':149C 'edit':20C 'error':192C 'evad':84C 'execut':61C 'field':91C 'filesystem':189C 'front':148C 'give':176C 'harness.run':58C 'hide':116C 'hostnam':104C,126C,175C 'id':155C 'imit':217C 'implement':48C 'infer':40C,196C 'infosteal':235C 'inspector':27C 'instead':221C 'intent':233C 'json':69C 'kam193':213C 'keep':141C 'key':75C 'launch':100C 'leak':187C 'level':74C 'librari':41C 'like':234C 'line':23C 'local':188C 'mal':6A,9A 'malici':1A,13B,227C,232C 'mine':119C,209C 'miner':225C 'monero/randomx/cryptonight/stratum/hashrate/donate':56C 'ol':82C 'open':108C 'oper':178C 'packag':14B,31C,216C 'parallel':151C 'path':190C 'payload':51C 'per':15C,181C 'per-victim':180C 'po':81C 'pool':120C,210C 'post':153C 'present':32C 'protocol':90C 'pypi':5A 'python':157C 'raw':110C 'readabl':144C 'readm':204C 'real':118C,218C 'reason':240C 'run':154C 'second':94C 'self._hb':152C 'ship':43C 'sourc':16C,24C,212C 'spawn':63C 'speech':39C 'state':156C 'static':85C 'step/loss/tok/s':199C 'stratum':89C,208C 'stratum-protocol':88C 'string':57C,79C 'subprocess.popen':66C 'tcp':103C,111C 'telemetri':183C 'terminolog':200C 'text':37C 'text-to-speech':36C 'timestamp':164C 'top':73C 'top-level':72C 'trace':193C 'traceback':158C 'traffic':143C 'tts':195C 'tunnel':112C 'two':44C 'url':105C 'user/pass/keepalive/tls':92C 'via':65C 'victim':182C 'voxcpmtts3':4A,12A 'voxcpmtts3/bin/cloudflared':97C 'voxcpmtts3/bin/voxcpm-core':52C 'voxev':239C 'whose':71C 'xmrig':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-03T04:47:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17463","url":"https://osv.dev/vulnerability/MAL-2026-17463","severity":"critical","published_at":"2026-10-03T04:47:46+00:00","modified_at":"2026-10-04T23:45:21+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}