The ai-perf-toolkit PyPI package version 2.4.2 includes embedded malicious code that activates cryptomining during the import process. The mining operation uses a hardcoded wallet address and depends on the presence of mining software already installed on the victim's system. This malicious campaign is categorized under cryptominer threats and is identified as MAL-2026-11197 in the OSV database. There is no CVSS score assigned, and no known exploits in the wild have been reported. The package is not a cloud service, and no official patch or remediation has been provided.

Systems importing ai-perf-toolkit version 2.4.2 may unknowingly participate in unauthorized cryptocurrency mining, leading to resource exhaustion such as CPU and power consumption. This can degrade system performance and increase operational costs. The malicious code requires pre-existing mining software, so impact depends on that software's presence. There is no indication of data theft or further compromise beyond cryptomining.

No official patch or remediation is currently available for ai-perf-toolkit version 2.4.2. Users should avoid installing or importing this specific version of the package. Remove any existing installations of ai-perf-toolkit 2.4.2 from systems. Monitor for unauthorized cryptomining activity and uninstall any mining software not explicitly authorized. Check vendor advisories or PyPI for updates or safer package versions before reinstallation.