Hostile 93% python Download

voxcpmtts3 0.1.2

Bundled XMRig crypto miner

“Evaluation harness for VoxCPM TTS CPU inference workloads”

Python silently exfiltrates process environmentDetects Linux.Trojan.Pornoasset
SHA-2569509cb196a001b1244c289c2af4614a4022a449c865859188da28ddd65170d46
URLhttps://files.pythonhosted.org/packages/50/0d/3aeafab9f4ff86f5b6de101cae70e59260aa6c57917289da5c4cb1a39054/voxcpmtts3-0.1.2-py3-none-any.whl
MaleculeK₃(LiLuTe₂)O₁₀(Eu₂C₅I₃AsCaDy₂Er₃LaP₂S)H₉(Cm₄₈Cr₁₃Db₁₀F₁₈MgOs₁₆Po₁₅Ti₂U)Md₇(Bi₄BkHe₂In₆PaPt)Th₂

Also flagged by osv (MAL-2026-17463: Malicious code in voxcpmtts3 (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.