Suspicious 80% python Download

voxeval 0.4.4

Bundled XMRig cryptominer

“Evaluation harness for VoxTTS CPU inference workloads”

Detect XMRig crpytominer targeting UnixDetects Linux.Trojan.Pornoasset
SHA-256b6e726b80225de9bfacd1815c4ce8a91e18348f56ea2963f453f6f012f3252af
URLhttps://files.pythonhosted.org/packages/be/8b/e745eb5ce55fa5e080767f6f52a926b071d7f53afe2d73405a4d352a8573/voxeval-0.4.4-py3-none-any.whl
MaleculeK₃(AmLiLu)O₃(C₆ErI₂)H₉(Cm₃₉Cr₁₆Db₉F₁₉MgOs₁₈Po₁₆Ti₂U)Md₇(Bi₃HeIn₅Pa₂PtV)Th₄

Also flagged by osm (The package imitates real activity and instead deploys a coin miner. The package comes with a xmrig binary and disguises the cryptocurrency miner as a VoxTTS evaluation harness, with optional Cloudfl…), osv (MAL-2026-17457: Malicious code in voxeval (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.