Hostile 93% python Download

voxcpmtts3 0.1.1

Bundled XMRig crypto miner

“Evaluation harness for VoxCPM TTS CPU inference workloads”

Python silently exfiltrates process environmentDetects Linux.Trojan.Pornoasset
SHA-256c3040f2ace4d076abbf581e3a5a1dd27b780ed0d5a5791cccf869a7aa6962fab
URLhttps://files.pythonhosted.org/packages/1e/9b/f6a490f540d938d69622df674b7a7d38cbccd857c647660ed0fa25f4f034/voxcpmtts3-0.1.1-py3-none-any.whl
MaleculeK₃(LiLuTe₂)O₁₀(Eu₂C₄I₃AsCaDy₂Er₃LaP₂S)H₉(Cm₄₈Cr₁₃Db₁₀F₁₈MgOs₁₆Po₁₄Ti₂U)Md₇(Bi₄BkHe₂In₆PaPt)Th₂

Also flagged by osv (MAL-2026-17463: Malicious code in voxcpmtts3 (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.