{"id":"MAL-2026-17469","kind":"package","aliases":["MAL-2026-17469"],"related":[],"title":"Malicious code in infrabench (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6)\nThe package's public API harness.run(edge=<host>) downloads two sha256-pinned gzipped native binaries ('inference-core.bin.gz' and 'edge-conn.bin.gz') from https://<edge>/files/, chmods them 0755, and spawns them on the installer's host. The caller-supplied edge argument chooses only the delivery CDN; the binary contents are fixed by the author via the pinned hashes. The surrounding Python code emits a synthetic, deterministic progress trace (fabricated step/loss/tok-s lines) rather than real benchmark data, so the advertised 'evaluation harness' purpose does not match the behavior of the fetched code. The JSON configuration passed to the 'inference-core' binary — pools:[{url,user,pass:'vox',keepalive,tls}], cpu:{enabled,threads,mem-locked}, cache-budget, log-period, autosave — matches the xmrig-family mining-pool client schema rather than any inference or benchmarking worker schema, and the second binary (~19MB) is invoked as 'access tcp --hostname <host> --url 127.0.0.1:<port>', the Cloudflare cloudflared access-tunnel CLI shape used to reach a pool endpoint behind a tunnel. A _hb() routine additionally POSTs run id, state, and up to 4000 characters of exception traceback to https://<edge>/hb as an operator heartbeat/control-plane check-in. Installing and invoking the harness causes the installer's machine to execute author-controlled native code and donate CPU to an operator-controlled mining pool under a fake benchmarking cover story.\n\n## Source: kam193 (4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"infrabench","fixed":[],"affected":"= 0.1.0; = 0.1.1; = 0.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-03T16:21:40+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':278C '-17469':8A,11A '-2026':7A,10A '/files':48C '/hb':211C '0755':51C '127.0.0.1':176C '19mb':168C '2026':277C '4000':205C '4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70':254C '97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6':28C 'access':172C,181C 'access-tunnel':180C 'activ':259C 'addit':197C 'advertis':103C 'amazon':26C 'amazon-inspector':25C 'api':33C 'argument':65C 'author':78C,232C 'author-control':231C 'autosav':145C 'base':281C 'behavior':111C 'behind':191C 'benchmark':99C,161C,249C 'binari':43C,72C,125C,167C 'budget':141C 'cach':140C 'cache-budget':139C 'caller':62C 'caller-suppli':61C 'campaign':269C,276C,284C 'categori':266C 'caus':224C 'cdn':70C 'charact':206C 'check':217C 'check-in':216C 'chmod':49C 'choos':66C 'clear':271C 'cli':183C 'client':154C 'cloudflar':178C,179C 'code':2A,86C,115C,235C 'coin':264C 'configur':118C 'content':73C 'control':233C,243C 'core':124C 'cover':250C 'cpu':133C,238C 'cryptomin':285C 'data':100C 'deliveri':69C 'deploy':262C 'detail':17C 'determinist':90C 'donat':237C 'download':36C 'edg':35C,64C 'edge-conn.bin.gz':46C 'edit':20C 'emit':87C 'enabl':134C 'endpoint':190C 'evalu':104C 'except':208C 'execut':230C 'fabric':93C 'fake':248C 'famili':150C 'fetch':114C 'fix':75C 'gzip':41C 'har':105C,223C 'harness.run':34C 'hash':82C 'hb':195C 'heartbeat/control-plane':215C 'host':59C 'hostnam':174C 'id':200C 'imit':257C 'infer':123C,159C 'inference-cor':122C 'inference-core.bin.gz':44C 'infosteal':275C 'infrabench':4A,12A 'inspector':27C 'instal':57C,219C,226C 'instead':261C 'intent':273C 'invok':170C,221C 'json':117C 'kam193':253C 'keepal':131C 'like':274C 'line':23C,95C 'lock':138C 'log':143C 'log-period':142C 'machin':228C 'mal':6A,9A 'malici':1A,13B,267C,272C 'match':109C,146C 'mem':137C 'mem-lock':136C 'mine':152C,244C 'miner':265C 'mining-pool':151C 'nativ':42C,234C 'oper':214C,242C 'operator-control':241C 'packag':14B,30C,256C 'pass':119C,129C 'per':15C 'period':144C 'pin':40C,81C 'pool':126C,153C,189C,245C 'post':198C 'progress':91C 'public':32C 'purpos':106C 'pypi':5A 'python':85C 'rather':96C,156C 'reach':187C 'real':98C,258C 'reason':280C 'routin':196C 'run':199C 'schema':155C,163C 'second':166C 'sha256':39C 'sha256-pinned':38C 'shape':184C 'sourc':16C,24C,252C 'spawn':53C 'state':201C 'step/loss/tok-s':94C 'stori':251C 'suppli':63C 'surround':84C 'synthet':89C 'tcp':173C 'thread':135C 'tls':132C 'trace':92C 'traceback':209C 'tunnel':182C,193C 'two':37C 'url':127C,175C 'use':185C 'user':128C 'via':79C 'vox':130C 'voxev':279C 'worker':162C 'xmrig':149C 'xmrig-famili':148C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-03T16:21:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17469","url":"https://osv.dev/vulnerability/MAL-2026-17469","severity":"critical","published_at":"2026-10-03T16:21:40+00:00","modified_at":"2026-10-04T23:45:21+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}