The voxeval package versions 0.4.2, 0.4.3, 0.4.4, and 0.4.5 on PyPI have been identified as malicious. Instead of performing legitimate operations, these versions deploy a coin miner, exploiting users who install the package. This campaign is categorized as malicious with cryptomining as the primary threat vector. There is no CVSS score or known exploits in the wild reported for this threat.

Users who install the affected voxeval package versions risk unauthorized use of their computing resources for cryptocurrency mining, which can degrade system performance and increase power consumption. There is no indication of data theft or other impacts beyond cryptomining.

Avoid installing the affected versions of the voxeval package (0.4.2 to 0.4.5). Remove any existing installations of these versions from systems. Since no official patch or fix is indicated, users should rely on trusted package sources and verify package integrity before installation.