{"id":"MAL-2026-17471","kind":"package","aliases":["MAL-2026-17471"],"related":[],"title":"Malicious code in caoxiltts (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62)\nThe package advertises itself as a TTS inference helper but harness.run() downloads two gzipped ELF binaries from a configurable host, verifies them against author-pinned SHA256 hashes, writes them to /tmp/.caoxiltts, chmods 0755, and executes them. The 'inference-core' binary is launched with a JSON configuration whose schema (pools[].url/user/pass/keepalive/tls, cpu.threads, mem-locked, cache-budget, autosave) is the XMRig cryptominer configuration shape, not a text-to-speech inference worker. The second binary 'edge-connector' is invoked as `access tcp --hostname <edge> --url 127.0.0.1:<port>`, matching the Cloudflare Access/cloudflared tunnel CLI shape, exposing a local port outbound through an author-controlled edge. The author-pinned hashes mean the exact bytes executed on the installer's host are chosen by the publisher, and the config/invocation pattern contradicts the package's declared TTS purpose. A supporting _report() helper additionally POSTs run_id, run state, and up to 4000 characters of exception tracebacks (which can carry local path and environment details) to https://<store>/hb on the same host serving the dropped binaries.\n\n## Source: kam193 (c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"caoxiltts","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-03T19:41:50+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':228C '-17471':8A,11A '-2026':7A,10A '/hb':193C '/tmp/.caoxiltts':60C '0755':62C '127.0.0.1':116C '2026':227C '23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62':28C '4000':179C 'access':112C 'access/cloudflared':120C 'activ':209C 'addit':170C 'advertis':31C 'amazon':26C 'amazon-inspector':25C 'author':53C,132C,137C 'author-control':131C 'author-pin':52C,136C 'autosav':88C 'base':231C 'binari':44C,70C,105C,201C 'budget':87C 'byte':143C 'c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f':204C 'cach':86C 'cache-budget':85C 'campaign':219C,226C,234C 'caoxiltt':4A 'caoxiltts':12A 'carri':186C 'categori':216C 'charact':180C 'chmod':61C 'chosen':151C 'clear':221C 'cli':122C 'cloudflar':119C 'code':2A 'coin':214C 'config/invocation':157C 'configur':47C,76C,93C 'connector':108C 'contradict':159C 'control':133C 'core':69C 'cpu.threads':81C 'cryptomin':92C,235C 'declar':163C 'deploy':212C 'detail':17C,191C 'download':40C 'drop':200C 'edg':107C,134C 'edge-connector':106C 'edit':20C 'elf':43C 'environ':190C 'exact':142C 'except':182C 'execut':64C,144C 'expos':124C 'gzip':42C 'harness.run':39C 'hash':56C,139C 'helper':37C,169C 'host':48C,149C,197C 'hostnam':114C 'id':173C 'imit':207C 'infer':36C,68C,101C 'inference-cor':67C 'infosteal':225C 'inspector':27C 'instal':147C 'instead':211C 'intent':223C 'invok':110C 'json':75C 'kam193':203C 'launch':72C 'like':224C 'line':23C 'local':126C,187C 'lock':84C 'mal':6A,9A 'malici':1A,13B,217C,222C 'match':117C 'mean':140C 'mem':83C 'mem-lock':82C 'miner':215C 'outbound':128C 'packag':14B,30C,161C,206C 'path':188C 'pattern':158C 'per':15C 'pin':54C,138C 'pool':79C 'port':127C 'post':171C 'publish':154C 'purpos':165C 'pypi':5A 'real':208C 'reason':230C 'report':168C 'run':172C,174C 'schema':78C 'second':104C 'serv':198C 'sha256':55C 'shape':94C,123C 'sourc':16C,24C,202C 'speech':100C 'state':175C 'support':167C 'tcp':113C 'text':98C 'text-to-speech':97C 'traceback':183C 'tts':35C,164C 'tunnel':121C 'two':41C 'url':115C 'url/user/pass/keepalive/tls':80C 'verifi':49C 'voxev':229C 'whose':77C 'worker':102C 'write':57C 'xmrig':91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-03T19:41:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17471","url":"https://osv.dev/vulnerability/MAL-2026-17471","severity":"critical","published_at":"2026-10-03T19:41:50+00:00","modified_at":"2026-10-04T23:45:21+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}