Malicious Code Detected in infrabench Package: Coin Miner Deployment
Summary
MAL-2026-17469: Malicious code in infrabench (PyPI). Affects infrabench versions 0.1.0 – 0.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The infrabench package, available on PyPI, is designed to benchmark various aspects of Python applications. It is intended for developers looking to assess performance metrics. However, a recent vulnerability has been identified where the package has been compromised to deploy malicious code, specifically a coin miner, instead of performing its intended functions.
Vulnerability Detail
The vulnerability originates from a malicious actor, identified as kam193, who has injected code into the infrabench package. This code mimics legitimate activity while secretly running a cryptominer, which can lead to unauthorized resource usage, potential data breaches, and significant performance degradation of affected systems. The malicious campaign is categorized under '2026-10-voxeval' and affects versions 0.1.0, 0.1.1, and 0.2.0 of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall infrabenchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can uninstall the infrabench package until a secure version is confirmed. This can be done using the command: 'pip uninstall infrabench'. Additionally, consider using alternative benchmarking tools that are known to be secure.
Conclusion
The infrabench package has been compromised to deploy malicious code, specifically a coin miner. Users are advised to uninstall the affected versions and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications without the need for complex setups.
See every vulnerability recorded for infrabench →
FAQ
The infrabench package is used for benchmarking various performance metrics in Python applications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
If you have installed versions 0.1.0, 0.1.1, or 0.2.0 of infrabench, it is crucial to uninstall the package and replace it with a secure alternative or wait for a patched version.
The vulnerability was reported by Kamil Mańkowski, who can be contacted through their GitHub profile at https://github.com/kam193.
Using the compromised package can lead to unauthorized resource consumption, potential data breaches, and overall performance issues in your applications.
