Cryptominer Deployment in voxcpmruntime Package - Malicious Code Detected
Summary
MAL-2026-17470: Malicious code in voxcpmruntime (PyPI). Affects voxcpmruntime versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The voxcpmruntime package, available on PyPI, is designed to provide runtime functionalities for various applications. However, it has been compromised to include malicious code that mimics legitimate activity while secretly deploying a cryptominer. This vulnerability poses significant risks to users, as it can lead to unauthorized resource usage and potential data breaches.
Vulnerability Detail
The vulnerability originates from a malicious actor who has injected code into the voxcpmruntime package. This code operates as a cryptominer, utilizing the system's resources without the user's consent. The implications of this vulnerability include increased CPU usage, potential overheating of hardware, and unauthorized access to sensitive information. The malicious code was identified in version 0.1.0 of the package, making it critical for users to be aware of the risks associated with this version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall voxcpmruntimeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can uninstall the compromised package using the command: pip uninstall voxcpmruntime. This will prevent the malicious code from executing until a secure version is available.
Conclusion
The voxcpmruntime package has been compromised to include malicious code that deploys a cryptominer. Users are advised to uninstall the affected version and monitor for any updates or alternatives. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in open-source software.
See every vulnerability recorded for voxcpmruntime →
FAQ
voxcpmruntime is a Python package available on PyPI that provides runtime functionalities for applications. However, it has been compromised to include malicious code.
The malicious code operates as a cryptominer, which can lead to increased CPU usage, potential overheating, and unauthorized access to sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have version 0.1.0 of voxcpmruntime installed, you should uninstall it immediately and check for any patched versions or alternatives.
Vulert is a monitoring tool that uses Pipfile.lock to alert users in real-time about open-source vulnerabilities in their software, helping to maintain security.
