MAL-2026-17471

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/caoxiltts/MAL-2026-17471.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17471
Published
2026-10-03T19:41:50Z
Modified
2026-10-04T23:45:21Z
Summary
Malicious code in caoxiltts (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62)

The package advertises itself as a TTS inference helper but harness.run() downloads two gzipped ELF binaries from a configurable host, verifies them against author-pinned SHA256 hashes, writes them to /tmp/.caoxiltts, chmods 0755, and executes them. The 'inference-core' binary is launched with a JSON configuration whose schema (pools[].url/user/pass/keepalive/tls, cpu.threads, mem-locked, cache-budget, autosave) is the XMRig cryptominer configuration shape, not a text-to-speech inference worker. The second binary 'edge-connector' is invoked as access tcp --hostname <edge> --url 127.0.0.1:<port>, matching the Cloudflare Access/cloudflared tunnel CLI shape, exposing a local port outbound through an author-controlled edge. The author-pinned hashes mean the exact bytes executed on the installer's host are chosen by the publisher, and the config/invocation pattern contradicts the package's declared TTS purpose. A supporting _report() helper additionally POSTs run_id, run state, and up to 4000 characters of exception tracebacks (which can carry local path and environment details) to https:///hb on the same host serving the dropped binaries.

Source: kam193 (c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f)

The package imitates real activity and instead deploys a coin miner.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

  • cryptominer
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voxeval/caoxiltts",
            "import_time": "2026-10-03T20:22:43.251097267Z",
            "modified_time": "2026-10-03T19:41:50.061768Z",
            "sha256": "c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-020901",
            "import_time": "2026-10-04T23:40:39.993302728Z",
            "modified_time": "2026-10-04T23:16:54Z",
            "sha256": "819b8ae45e8f696b31aa78bf56a0a51b85b4612be1bfec9c5fbe2fb5452e4f3e",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-020898",
            "import_time": "2026-10-04T23:40:39.67888865Z",
            "modified_time": "2026-10-04T23:16:24Z",
            "sha256": "23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / caoxiltts

Package

Name
caoxiltts
View open source insights on deps.dev
Purl
pkg:pypi/caoxiltts

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "caoxiltts/__init__.py",
            "sha256": "aa0409606f6902264198907cfc236fd6b80b8cf22d97b706cdc083b4d15c9089",
            "tlsh": "9a42a5a2cd211d6383538a564963e952b70ab98757091830bdec831c2f69674c2f6fff"
        }
    ],
    "package_integrity": [
        {
            "filename": "caoxiltts-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "73e9fb430a6a17cd7d247eaadff048336f05e012c338821a8302d1070f024a5f",
                "md5": "066ae0db0409cb0c8b73e28e9843eb77",
                "sha256": "52b1d16be3eaedbc1d2eb45bed547819c95da4eabebac3e564e30dafcda155ad"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/caoxiltts/MAL-2026-17471.json"