{"id":"MAL-2026-17457","summary":"Malicious code in voxeval (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a)\nThe package imitates real activity and instead deploys a coin miner.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voxeval\n\n\nReasons (based on the campaign):\n\n\n - cryptominer\n","modified":"2026-10-02T23:45:03.400823645Z","published":"2026-10-02T21:28:42Z","database_specific":{"malicious-packages-origins":[{"versions":["0.4.2","0.4.3","0.4.4","0.4.5"],"id":"pypi/2026-10-voxeval/voxeval","import_time":"2026-10-02T21:41:25.235176359Z","modified_time":"2026-10-02T21:28:42.41347Z","sha256":"4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a","source":"kam193"},{"modified_time":"2026-10-02T22:25:09.940191Z","sha256":"b9e9f292852286c6537dcd1e5d4047dc3126a413f7d65385b54304156f2b6a83","source":"kam193","versions":["0.4.2","0.4.3","0.4.4","0.4.5"],"id":"pypi/2026-10-voxeval/voxeval","import_time":"2026-10-02T22:41:28.867292387Z"},{"sha256":"a489350e0f4586ebe4658874a085f3f100ada8bb1018a2b603b624ee0516c58f","source":"kam193","versions":["0.4.2","0.4.3","0.4.4","0.4.5"],"id":"pypi/2026-10-voxeval/voxeval","import_time":"2026-10-02T23:39:22.663770673Z","modified_time":"2026-10-02T23:19:56.752864Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxeval"}],"affected":[{"package":{"name":"voxeval","ecosystem":"PyPI","purl":"pkg:pypi/voxeval"},"versions":["0.4.2","0.4.3","0.4.4","0.4.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxeval/MAL-2026-17457.json"}}],"schema_version":"1.9.0","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}