Malicious code in infrabench (PyPI)

The infrabench package, distributed via PyPI, is a malicious package that masquerades as a legitimate tool but instead deploys a coin miner on the victim's system. This behavior classifies it as malware with cryptomining capabilities. The campaign associated with this package is labeled 2026-10-voxeval. There is no CVSS score available, and no known exploits in the wild have been reported. The affected versions explicitly identified are 0.1.0, 0.1.1, and 0.2.0.

Systems that install the infrabench package versions 0.1.0, 0.1.1, or 0.2.0 may have unauthorized cryptocurrency mining software deployed, which can degrade system performance, increase power consumption, and potentially expose the system to further compromise. There are no reports of active exploitation in the wild at this time.

Users should avoid installing the infrabench package versions 0.1.0, 0.1.1, and 0.2.0 from PyPI. If already installed, remove the package and scan affected systems for unauthorized mining processes. Since no official patch or remediation is indicated, the best mitigation is to avoid use and remove the malicious package.