Malicious Code Detected in voxcpmtts3 Package - Coin Miner Deployment
Summary
MAL-2026-17463: Malicious code in voxcpmtts3 (PyPI). Affects voxcpmtts3 versions 0.1.0 – 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The voxcpmtts3 package, available on PyPI, is designed for text-to-speech functionalities. However, it has been identified as a malicious package that mimics legitimate activities while secretly deploying a coin miner, compromising users' systems and resources.
Vulnerability Detail
The vulnerability originates from the package's malicious intent, as it is designed to deploy a cryptominer instead of performing its advertised functions. This can lead to significant resource drain on affected systems, potential data loss, and unauthorized use of computing power for cryptocurrency mining.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall voxcpmtts3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should refrain from using the voxcpmtts3 package and consider alternative packages that provide similar functionality without the risk of malicious behavior.
Conclusion
The voxcpmtts3 package has been identified as malicious, deploying a coin miner instead of providing its intended functionality. Users are advised to uninstall the package immediately and consider alternative solutions. Regular monitoring of packages for vulnerabilities is essential to maintain system integrity.
See every vulnerability recorded for voxcpmtts3 →
FAQ
voxcpmtts3 is a Python package available on PyPI that was intended for text-to-speech functionalities but has been found to contain malicious code.
If you have installed the voxcpmtts3 package, your system may be affected. You can check your installed packages using pip list and look for voxcpmtts3.
You should uninstall the voxcpmtts3 package immediately using the command pip uninstall voxcpmtts3.
Yes, consider using other reputable text-to-speech libraries available on PyPI that do not have known vulnerabilities.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software in real-time. You can check your application against known vulnerabilities using the Vulert playground without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
