Hostile 93% python Download

voxcpmintel 0.1.0

Bundled XMRig miner binary

“CPU inference runtime for VoxCPM text-to-speech evaluation”

Python silently exfiltrates process environmentDetects Linux.Trojan.Pornoasset
SHA-256bdf89f7fcaae3687e4585d83a28775292a57cec278cee622ff9a91d84fac59ca
URLhttps://files.pythonhosted.org/packages/ce/8b/722c6274abf19100558b25570208ec71a21f489edf7cf063341a828a70a9/voxcpmintel-0.1.0-py3-none-manylinux_2_17_x86_64.whl
MaleculeK₃(LiLuTe₂)O₁₀(Eu₂C₅AsCaDy₂Er₃ILaP₂S)H₉(Cm₄₈Cr₁₃Db₁₀F₁₈MgOs₁₅Po₁₅Ti₂U)Md₇(Bi₄BkHe₂In₆PaPt)Th₂

Also flagged by osv (MAL-2026-17468: Malicious code in voxcpmintel (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.