Cryptominer Deployment in voxcpmui3 Package - Malicious Code Detected
Summary
MAL-2026-17464: Malicious code in voxcpmui3 (PyPI). Affects voxcpmui3 versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The voxcpmui3 package, available on the Python Package Index (PyPI), is designed to provide specific functionalities for Python developers. However, it has been identified as malicious, as it mimics legitimate activity while secretly deploying a coin miner, which can lead to unauthorized resource usage and potential data breaches.
Vulnerability Detail
The vulnerability originates from the package's malicious intent, where it disguises itself as a legitimate tool but instead installs a cryptominer. This can result in significant performance degradation of the host system, unauthorized use of computing resources, and potential exposure of sensitive information. The malicious code was traced back to the source identified as kam193, with a specific SHA256 hash of 5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall voxcpmui3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can uninstall the voxcpmui3 package to prevent any malicious activity. Use the following command: pip uninstall voxcpmui3.
Conclusion
The voxcpmui3 package has been identified as malicious, deploying a cryptominer under the guise of legitimate functionality. Users are advised to uninstall the package and monitor their systems for any unusual activity. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for voxcpmui3 →
FAQ
voxcpmui3 is a Python package available on PyPI, intended for specific functionalities in Python development.
The malicious code operates by mimicking legitimate activities while secretly deploying a cryptominer, consuming system resources without user consent.
The risks include unauthorized resource usage, potential data breaches, and performance degradation of the affected systems.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock. You can check your application for vulnerabilities without signup at the Vulert playground.
If you have installed voxcpmui3, it is recommended to uninstall it immediately and check for any updates or patches from the official repository.
