{"id":"MAL-2026-17470","kind":"package","aliases":["MAL-2026-17470"],"related":[],"title":"Malicious code in voxcpmruntime (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef6e0220a1b37d6391262539694a04726e2e5aea888941b384c4048d0a2443b2)\nThe package presents itself as a VoxCPM TTS runtime but is a binary dropper and cryptominer loader. harness.run() downloads two executables ('voxcpm-core' and 'cloudflared') from a caller-supplied edge host at https://<edge>/files/<name>, writes them under /tmp/.voxcpm-runtime/, chmods them 0o755, and spawns them. The bytes are opaque, publisher-unpinned, and verified only against SHA-256 values hardcoded in the wheel, so any host that serves the author's precomputed hashes is accepted. 'cloudflared' is launched as `access tcp --hostname <edge> --url 127.0.0.1:<port>` to tunnel a local TCP port through Cloudflare and conceal the real control-plane host. The JSON configuration written to voxcpm-run.json and passed to 'voxcpm-core' as `--config=<path>` is a stratum mining-pool document (pools[{url,user,pass,keepalive,tls}], cpu.{threads,mem-locked}); the keys 'pools' and '--config=' are assembled by string concatenation ('po'+'ols', '--'+'config='+cfg_path) to evade miner-config string matching, and a _Progress class prints fabricated training-loss and tokens-per-second lines to disguise the resulting CPU load as ML inference. harness._hb() additionally POSTs run_id, state, truncated Python tracebacks and timestamps to https://<edge>/hb as a heartbeat channel, later routed through the Cloudflare tunnel. The name voxcpmruntime closely resembles the legitimate VoxCPM project from OpenBMB.\n\n## Source: kam193 (12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"voxcpmruntime","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-03T14:42:59+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':267C '-17470':8A,11A '-2026':7A,10A '-256':86C '/files':63C '/hb':219C '/tmp/.voxcpm-runtime':67C '0o755':70C '127.0.0.1':112C '12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba':243C '2026':266C 'accept':103C 'access':108C 'activ':248C 'addit':208C 'amazon':26C 'amazon-inspector':25C 'assembl':167C 'author':98C 'base':270C 'binari':41C 'byte':75C 'caller':58C 'caller-suppli':57C 'campaign':258C,265C,273C 'categori':255C 'cfg':174C 'channel':223C 'chmod':68C 'class':186C 'clear':260C 'close':233C 'cloudflar':54C,104C,120C,228C 'code':2A 'coin':253C 'concaten':170C 'conceal':122C 'config':142C,165C,173C,180C 'configur':131C 'control':126C 'control-plan':125C 'core':52C,140C 'cpu':156C,202C 'cryptomin':44C,274C 'deploy':251C 'detail':17C 'disguis':199C 'document':149C 'download':47C 'dropper':42C 'edg':60C 'edit':20C 'ef6e0220a1b37d6391262539694a04726e2e5aea888941b384c4048d0a2443b2':28C 'evad':177C 'execut':49C 'fabric':188C 'hardcod':88C 'harness._hb':207C 'harness.run':46C 'hash':101C 'heartbeat':222C 'host':61C,94C,128C 'hostnam':110C 'id':211C 'imit':246C 'infer':206C 'infosteal':264C 'inspector':27C 'instead':250C 'intent':262C 'json':130C 'kam193':242C 'keepal':154C 'key':162C 'later':224C 'launch':106C 'legitim':236C 'like':263C 'line':23C,197C 'load':203C 'loader':45C 'local':116C 'lock':160C 'loss':191C 'mal':6A,9A 'malici':1A,13B,256C,261C 'match':182C 'mem':159C 'mem-lock':158C 'mine':147C 'miner':179C,254C 'miner-config':178C 'mining-pool':146C 'ml':205C 'name':231C 'ol':172C 'opaqu':77C 'openbmb':240C 'packag':14B,30C,245C 'pass':136C,153C 'path':175C 'per':15C,195C 'plane':127C 'po':171C 'pool':148C,150C,163C 'port':118C 'post':209C 'precomput':100C 'present':31C 'print':187C 'progress':185C 'project':238C 'publish':79C 'publisher-unpin':78C 'pypi':5A 'python':214C 'real':124C,247C 'reason':269C 'resembl':234C 'result':201C 'rout':225C 'run':210C 'runtim':37C 'second':196C 'serv':96C 'sha':85C 'sourc':16C,24C,241C 'spawn':72C 'state':212C 'stratum':145C 'string':169C,181C 'suppli':59C 'tcp':109C,117C 'thread':157C 'timestamp':217C 'tls':155C 'token':194C 'tokens-per-second':193C 'traceback':215C 'train':190C 'training-loss':189C 'truncat':213C 'tts':36C 'tunnel':114C,229C 'two':48C 'unpin':80C 'url':111C,151C 'user':152C 'valu':87C 'verifi':82C 'voxcpm':35C,51C,139C,237C 'voxcpm-cor':50C,138C 'voxcpm-run.json':134C 'voxcpmruntim':4A,232C 'voxcpmruntime':12A 'voxev':268C 'wheel':91C 'write':64C 'written':132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-03T14:42:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17470","url":"https://osv.dev/vulnerability/MAL-2026-17470","severity":"critical","published_at":"2026-10-03T14:42:59+00:00","modified_at":"2026-10-05T04:15:04+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}