Hostile 93% python Download

voxeval 0.4.2

XMRig cryptominer disguised as TTS harness

“Evaluation harness for VoxTTS CPU inference workloads”

Detects Linux.Trojan.PornoassetDetects Multi.Cryptominer.Xmrig
SHA-25629c671e9b108237ec2ca0d85dd588d8aaa1558c5a88e4c959c01a8db277d35cc
URLhttps://files.pythonhosted.org/packages/55/a4/199782852a7ca0a6b0fd0f4ac060601cacaa7df9022ecb52b0d940f52784/voxeval-0.4.2-py3-none-any.whl
MaleculeK₃(AmLiTe)O₅(I₂AsCDy₂S)H₉(Cm₁₀Cr₉Db₆F₁₁MgOs₈Po₁₁Ti₂U)Md₅(Bi₂He₂In₄Pa)Th₃

Also flagged by osm (The package imitates real activity and instead deploys a coin miner. The package comes with a xmrig binary and disguises the cryptocurrency miner as a VoxTTS evaluation harness, with optional Cloudfl…), osv (MAL-2026-17457: Malicious code in voxeval (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.