The 'voxcpmeval' package on PyPI, specifically version 0.1.0, is a malicious package that pretends to perform legitimate functions but instead installs and runs a cryptominer. This campaign, labeled '2026-10-voxeval', is categorized as malicious due to its clear intent to deploy unauthorized cryptomining software on victims' systems. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.

Systems that install the 'voxcpmeval' package version 0.1.0 may be compromised by unauthorized cryptomining activity, which can degrade system performance, increase power consumption, and potentially expose the system to further compromise. The malicious package abuses user trust in PyPI packages to execute unwanted code.

Users and administrators should avoid installing the 'voxcpmeval' package version 0.1.0 from PyPI. If already installed, remove the package and scan affected systems for cryptomining processes or related malicious activity. Since no official patch or fix is indicated, the best mitigation is to not use this package and rely on trusted sources. Monitor PyPI and vendor advisories for any updates or removal notices.