MAL-2026-17457

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxeval/MAL-2026-17457.json

JSON Data

https://api.test.osv.dev/v1/vulns/MAL-2026-17457

Published

2026-10-02T21:28:42Z

Modified

2026-10-02T23:45:03Z

Summary

Malicious code in voxeval (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a)

The package imitates real activity and instead deploys a coin miner.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

cryptominer

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voxeval/voxeval",
            "import_time": "2026-10-02T21:41:25.235176359Z",
            "modified_time": "2026-10-02T21:28:42.41347Z",
            "sha256": "4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a",
            "source": "kam193",
            "versions": [
                "0.4.2",
                "0.4.3",
                "0.4.4",
                "0.4.5"
            ]
        },
        {
            "id": "pypi/2026-10-voxeval/voxeval",
            "import_time": "2026-10-02T22:41:28.867292387Z",
            "modified_time": "2026-10-02T22:25:09.940191Z",
            "sha256": "b9e9f292852286c6537dcd1e5d4047dc3126a413f7d65385b54304156f2b6a83",
            "source": "kam193",
            "versions": [
                "0.4.2",
                "0.4.3",
                "0.4.4",
                "0.4.5"
            ]
        },
        {
            "id": "pypi/2026-10-voxeval/voxeval",
            "import_time": "2026-10-02T23:39:22.663770673Z",
            "modified_time": "2026-10-02T23:19:56.752864Z",
            "sha256": "a489350e0f4586ebe4658874a085f3f100ada8bb1018a2b603b624ee0516c58f",
            "source": "kam193",
            "versions": [
                "0.4.2",
                "0.4.3",
                "0.4.4",
                "0.4.5"
            ]
        }
    ]
}

References

https://bad-packages.kam193.eu/pypi/package/voxeval

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / voxeval

Package

Name: voxeval; View open source insights on deps.dev
Purl: pkg:pypi/voxeval

Affected ranges

Affected versions

0.*

0.4.2

0.4.3

0.4.4

0.4.5

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxeval/MAL-2026-17457.json"