Malicious code in voxcpmruntime (PyPI)
The voxcpmruntime package on PyPI is identified as malicious software that masquerades as legitimate activity but actually deploys a cryptocurrency miner. This package version 0.1.0 is involved in a campaign with clear malicious intent, specifically cryptomining.
AI Analysis
Technical Summary
The voxcpmruntime package version 0.1.0 on PyPI is a malicious package that pretends to perform legitimate functions but instead installs and runs a cryptominer. This behavior is part of a known malicious campaign labeled 2026-10-voxeval. There are no CVSS scores or detailed technical vulnerability data available. No known exploits in the wild have been reported. The package is flagged as malicious due to its cryptomining payload.
Potential Impact
The impact of this malicious package is the unauthorized use of system resources for cryptocurrency mining, which can degrade system performance and increase operational costs. There is no indication of data theft or other forms of compromise beyond cryptomining.
Mitigation Recommendations
Users should avoid installing the voxcpmruntime package version 0.1.0 from PyPI. If already installed, remove the package immediately and scan affected systems for cryptomining activity. No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software.
Malicious code in voxcpmruntime (PyPI)
Description
The voxcpmruntime package on PyPI is identified as malicious software that masquerades as legitimate activity but actually deploys a cryptocurrency miner. This package version 0.1.0 is involved in a campaign with clear malicious intent, specifically cryptomining.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The voxcpmruntime package version 0.1.0 on PyPI is a malicious package that pretends to perform legitimate functions but instead installs and runs a cryptominer. This behavior is part of a known malicious campaign labeled 2026-10-voxeval. There are no CVSS scores or detailed technical vulnerability data available. No known exploits in the wild have been reported. The package is flagged as malicious due to its cryptomining payload.
Potential Impact
The impact of this malicious package is the unauthorized use of system resources for cryptocurrency mining, which can degrade system performance and increase operational costs. There is no indication of data theft or other forms of compromise beyond cryptomining.
Defensive Guidance
Users should avoid installing the voxcpmruntime package version 0.1.0 from PyPI. If already installed, remove the package immediately and scan affected systems for cryptomining activity. No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17470
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6ac13969a43b0b3b89d5fb9f
Added to database: 10/03/2026, 17:20:41 UTC
Last enriched: 10/03/2026, 17:23:18 UTC
Last updated: 10/04/2026, 03:09:43 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.