Malicious Code Detected in voxel-tts: A Coin Miner Deployment
Summary
MAL-2026-17461: Malicious code in voxel-tts (PyPI). Affects voxel-tts versions 0.5.0 – 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The voxel-tts package, available on PyPI, is designed for text-to-speech functionalities. It aims to provide users with an easy way to convert text into spoken words. However, it has been compromised, and the malicious version mimics legitimate activity while secretly deploying a coin miner, which can lead to significant resource drain and potential data breaches for users.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2026-10-voxeval'. The affected versions of the voxel-tts package (0.5.0 and 0.5.1) contain code that masquerades as legitimate functionality but instead executes a cryptominer. This can result in unauthorized use of system resources, increased electricity costs, and potential exposure of sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall voxel-ttsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can uninstall the affected versions of voxel-tts using the command: 'pip uninstall voxel-tts'. This will prevent the execution of the malicious code until a secure version is installed.
Conclusion
The voxel-tts package has been compromised, deploying a coin miner under the guise of legitimate functionality. Users are urged to uninstall affected versions and update to secure releases to protect their systems from unauthorized resource usage and potential data breaches.
See every vulnerability recorded for voxel-tts →
FAQ
voxel-tts is a Python package that provides text-to-speech capabilities, allowing users to convert written text into spoken audio.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring signup.
If you have versions 0.5.0 or 0.5.1 of voxel-tts installed, you should uninstall them immediately and update to a secure version.
Using the compromised package can lead to unauthorized resource usage, increased costs, and potential data breaches due to the cryptominer's activities.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and keep your packages updated to the latest secure versions.
