MAL-2026-17461

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxel-tts/MAL-2026-17461.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17461
Published
2026-10-03T04:38:14Z
Modified
2026-10-04T23:45:21Z
Summary
Malicious code in voxel-tts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5)

The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxel_tts loads voxel_tts/harness.py, which instantiates a module-level Harness(); on run() it chmods and executes a bundled ~8MB ELF at voxel_tts/bin/voxel-core. The ELF is invoked with a JSON configuration matching the XMRig-family CPU mining schema (pools/user/pass/keepalive/tls, cpu.threads, cpu.mem-locked, cache-budget), and the pool-protocol key 'pools' is split across string concatenation to evade static scanners. The pool destination is reconstructed at runtime by base64-decoding two fragments ('MTg1LjE5NA==', 'MTc3LjI0OQ==') and joining them with '.', yielding 185.194.177.249:443. A 40MB cloudflared binary is also bundled at voxel_tts/bin/cloudflared and launched as 'cloudflared access tcp --hostname --url 127.0.0.1:' so that outbound mining traffic egresses through Cloudflare Access to an author-controlled hostname, hiding the real pool IP from host network logs; in-code comments acknowledge this is to avoid 'direct egress to the coordinator's own address'. In parallel, a _Progress helper emits synthetic 'model | step N/250000 loss=... tok/s=... lr=6e-5 ep=...' lines once per minute as a cover story to make the workload appear to be ML training. Net effect: installing and using this package runs a cryptominer on the installer's CPU, monetizing their compute for the author, while actively evading detection via destination obfuscation, tunneled egress, and a fabricated training-progress UI.

Source: kam193 (59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d)

The package imitates real activity and instead deploys a coin miner.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

  • cryptominer
Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-10-voxeval/voxel-tts",
            "import_time":  "2026-10-03T04:46:19.650415945Z",
            "modified_time":  "2026-10-03T04:38:14.625954Z",
            "sha256":  "59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d",
            "source":  "kam193",
            "versions":  [
                "0.5.0",
                "0.5.1"
            ]
        },
        {
            "id":  "pypi/2026-10-voxeval/voxel-tts",
            "import_time":  "2026-10-03T05:18:10.337930449Z",
            "modified_time":  "2026-10-03T04:38:14.625954Z",
            "sha256":  "d20f098625fe215d12359a89c03cd967a584ccc37a111c8127ce4889166af61e",
            "source":  "kam193",
            "versions":  [
                "0.5.0",
                "0.5.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020925",
            "import_time":  "2026-10-04T23:40:42.599068067Z",
            "modified_time":  "2026-10-04T23:20:41Z",
            "sha256":  "31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020927",
            "import_time":  "2026-10-04T23:40:42.825025391Z",
            "modified_time":  "2026-10-04T23:20:59Z",
            "sha256":  "598f8abf106d4dbdbbe4ce3aa3eca8d89b36b3a0d77d17f266849e46176e4913",
            "source":  "amazon-inspector",
            "versions":  [
                "0.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / voxel-tts

Package

Name
voxel-tts
View open source insights on deps.dev
Purl
pkg:pypi/voxel-tts

Affected ranges

Affected versions

0.*
0.5.0
0.5.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "voxel_tts/harness.py",
            "sha256":  "2b3194f9bc979acbb8ff8c46243921727e112381611067feccfeb2e69f5dfc53",
            "tlsh":  "59d171f6ca161a62c397ca164a57b583630aac53974e04347cfc83183f95674c2f1efa"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "voxel_tts-0.5.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "585acec603109e61864a2debeb9141919d0ef679d11af14fd8cc4ff5281fd45d",
                "md5":  "cfde97d0e997b7815f849eeadd0d6e83",
                "sha256":  "84e93a0ac30511ea48e94cfc1bba4cf49339c60dfabf4760e34604629c32e65b"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxel-tts/MAL-2026-17461.json"