voxel-tts

{"schema_version":"1.7.4","id":"MAL-2026-17461","published":"2026-10-03T04:38:14Z","modified":"2026-10-04T23:42:41.654999682Z","summary":"Malicious code in voxel-tts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5)\nThe package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxel_tts loads voxel_tts/harness.py, which instantiates a module-level Harness(); on run() it chmods and executes a bundled ~8MB ELF at voxel_tts/bin/voxel-core. The ELF is invoked with a JSON configuration matching the XMRig-family CPU mining schema (pools/user/pass/keepalive/tls, cpu.threads, cpu.mem-locked, cache-budget), and the pool-protocol key 'pools' is split across string concatenation to evade static scanners. The pool destination is reconstructed at runtime by base64-decoding two fragments ('MTg1LjE5NA==', 'MTc3LjI0OQ==') and joining them with '.', yielding 185.194.177.249:443. A 40MB cloudflared binary is also bundled at voxel_tts/bin/cloudflared and launched as 'cloudflared access tcp --hostname <host> --url 127.0.0.1:<port>' so that outbound mining traffic egresses through Cloudflare Access to an author-controlled hostname, hiding the real pool IP from host network logs; in-code comments acknowledge this is to avoid 'direct egress to the coordinator's own address'. In parallel, a _Progress helper emits synthetic 'model | step N/250000 loss=... tok/s=... lr=6e-5 ep=...' lines once per minute as a cover story to make the workload appear to be ML training. Net effect: installing and using this package runs a cryptominer on the installer's CPU, monetizing their compute for the author, while actively evading detection via destination obfuscation, tunneled egress, and a fabricated training-progress UI.\n\n## Source: kam193 (59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer\n","affected":[{"package":{"name":"voxel-tts","ecosystem":"PyPI"},"versions":["0.5.0","0.5.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"voxel_tts/harness.py","sha256":"2b3194f9bc979acbb8ff8c46243921727e112381611067feccfeb2e69f5dfc53","tlsh":"59d171f6ca161a62c397ca164a57b583630aac53974e04347cfc83183f95674c2f1efa"}],"package_integrity":[{"filename":"voxel_tts-0.5.0-py3-none-any.whl","hashes":{"blake2b_256":"585acec603109e61864a2debeb9141919d0ef679d11af14fd8cc4ff5281fd45d","md5":"cfde97d0e997b7815f849eeadd0d6e83","sha256":"84e93a0ac30511ea48e94cfc1bba4cf49339c60dfabf4760e34604629c32e65b"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxel-tts"},{"type":"PACKAGE","url":"https://pypi.org/project/voxel-tts/0.5.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/voxel-tts/0.5.1/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voxeval/voxel-tts","import_time":"2026-10-03T04:46:19.650415945Z","modified_time":"2026-10-03T04:38:14.625954Z","sha256":"59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d","source":"kam193","versions":["0.5.0","0.5.1"]},{"id":"pypi/2026-10-voxeval/voxel-tts","import_time":"2026-10-03T05:18:10.337930449Z","modified_time":"2026-10-03T04:38:14.625954Z","sha256":"d20f098625fe215d12359a89c03cd967a584ccc37a111c8127ce4889166af61e","source":"kam193","versions":["0.5.0","0.5.1"]},{"id":"IN-MAL-2026-020925","import_time":"2026-10-04T23:40:42.599068067Z","modified_time":"2026-10-04T23:20:41Z","sha256":"31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5","source":"amazon-inspector","versions":["0.5.0"]},{"id":"IN-MAL-2026-020927","import_time":"2026-10-04T23:40:42.825025391Z","modified_time":"2026-10-04T23:20:59Z","sha256":"598f8abf106d4dbdbbe4ce3aa3eca8d89b36b3a0d77d17f266849e46176e4913","source":"amazon-inspector","versions":["0.5.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}