Hostile 93% python Download

voxcpmeval 0.1.0

Bundled XMRig miner binary

“Evaluation harness for VoxCPM TTS CPU inference workloads”

Python silently exfiltrates process environmentDetects Linux.Trojan.Pornoasset
SHA-256b24cd285a2d44ae2c9f6e7a636016b4b1f6bbf4e98b1e77208805c0f6ab55278
URLhttps://files.pythonhosted.org/packages/95/41/e2120168f327d239f835804f00de0e82b95ced55fcb0fad702cae332d9aa/voxcpmeval-0.1.0-py3-none-any.whl
MaleculeK₃(LiLuTe₂)O₁₀(Eu₂C₅AsCaDy₂Er₃ILaP₂S)H₉(Cm₄₈Cr₁₃Db₁₀F₁₈MgOs₁₅Po₁₅Ti₂U)Md₇(Bi₄BkHe₂In₆PaPt)Th₂

Also flagged by osv (MAL-2026-17465: Malicious code in voxcpmeval (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.