{"id":"MAL-2026-17464","kind":"package","aliases":["MAL-2026-17464"],"related":[],"title":"Malicious code in voxcpmui3 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9db4ea82be2cd2e2d4d7eb40236b22a9ccd0e0414cad836b98ca63468c4071e)\nThe package presents itself as a text-to-speech inference harness but contains no TTS code. On calling the exported Harness.run, the module chmods +x and spawns a bundled ~8MB native binary at bin/voxcpm-core with a JSON config whose fields match a stratum mining pool (url/user/pass/keepalive/tls under a dict key, cpu.threads, cpu.mem-locked, cache-budget). The miner's pool-list key is assembled by string concatenation (\"po\"+\"ols\") rather than written as a literal, an evasion of static scanners that search for the literal key. A ~40MB cloudflared binary is also bundled and invoked as `cloudflared access tcp --hostname <edge> --url 127.0.0.1:<port>`, so the native core connects to loopback while traffic is tunneled through a Cloudflare-Access-protected hostname chosen by the caller — concealing the mining pool destination from network egress monitoring. The harness emits fabricated step/loss/tok-s progress lines generated from a seeded random.Random to maintain the training cover story. The combined effect is that installers who follow the README donate CPU cycles to the author's mining pool while the destination is obscured behind a tunneling binary.\n\n## Source: kam193 (5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"voxcpmui3","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-03T10:46:57+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':236C '-17464':8A,11A '-2026':7A,10A '127.0.0.1':132C '2026':235C '40mb':118C '5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c':212C '8mb':59C 'access':128C,148C 'activ':217C 'also':122C 'amazon':26C 'amazon-inspector':25C 'assembl':94C 'author':197C 'base':239C 'behind':206C 'bin/voxcpm-core':63C 'binari':61C,120C,209C 'budget':85C 'bundl':58C,123C 'cach':84C 'cache-budget':83C 'call':47C 'caller':154C 'campaign':227C,234C,242C 'categori':224C 'chmod':53C 'chosen':151C 'clear':229C 'cloudflar':119C,127C,147C 'cloudflare-access-protect':146C 'code':2A,45C 'coin':222C 'combin':183C 'concaten':97C 'conceal':155C 'config':67C 'connect':137C 'contain':42C 'core':136C 'cover':180C 'cpu':193C 'cpu.mem':81C 'cpu.threads':80C 'cryptomin':243C 'cycl':194C 'deploy':220C 'destin':159C,203C 'detail':17C 'dict':78C 'donat':192C 'e9db4ea82be2cd2e2d4d7eb40236b22a9ccd0e0414cad836b98ca63468c4071e':28C 'edit':20C 'effect':184C 'egress':162C 'emit':166C 'evas':107C 'export':49C 'fabric':167C 'field':69C 'follow':189C 'generat':171C 'har':40C,165C 'harness.run':50C 'hostnam':130C,150C 'imit':215C 'infer':39C 'infosteal':233C 'inspector':27C 'instal':187C 'instead':219C 'intent':231C 'invok':125C 'json':66C 'kam193':211C 'key':79C,92C,116C 'like':232C 'line':23C,170C 'list':91C 'liter':105C,115C 'lock':82C 'loopback':139C 'maintain':177C 'mal':6A,9A 'malici':1A,13B,225C,230C 'match':70C 'mine':73C,157C,199C 'miner':87C,223C 'modul':52C 'monitor':163C 'nativ':60C,135C 'network':161C 'obscur':205C 'ol':99C 'packag':14B,30C,214C 'per':15C 'po':98C 'pool':74C,90C,158C,200C 'pool-list':89C 'present':31C 'progress':169C 'protect':149C 'pypi':5A 'random.random':175C 'rather':100C 'readm':191C 'real':216C 'reason':238C 'scanner':110C 'search':112C 'seed':174C 'sourc':16C,24C,210C 'spawn':56C 'speech':38C 'static':109C 'step/loss/tok-s':168C 'stori':181C 'stratum':72C 'string':96C 'tcp':129C 'text':36C 'text-to-speech':35C 'traffic':141C 'train':179C 'tts':44C 'tunnel':143C,208C 'url':131C 'url/user/pass/keepalive/tls':75C 'voxcpmui3':4A,12A 'voxev':237C 'whose':68C 'written':102C 'x':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-03T10:46:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17464","url":"https://osv.dev/vulnerability/MAL-2026-17464","severity":"critical","published_at":"2026-10-03T10:46:57+00:00","modified_at":"2026-10-04T23:45:21+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}