Which versions of infrabench are malicious?

The following PyPI versions of infrabench are flagged malicious: 0.1.0, 0.1.1, 0.2.0. Treat any of these as compromised.

How do I remediate infrabench if I installed it?

infrabench is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed infrabench — how do I know if it already compromised me?

If infrabench was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is infrabench part of a known attack campaign?

Yes — infrabench is associated with the 2026-10-voxeval, IN-MAL-2026-020939, IN-MAL-2026-020941, IN-MAL-2026-020945 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find infrabench across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for infrabench (3 malicious versions).

Part of a larger attack: 2026-10-voxeval published 11 malicious packages. See the full campaign →

Malicious package

infrabenchPyPI

Advisory published Oct 3, 2026Updated Oct 4, 2026

infrabench is a confirmed malicious PyPI package (MAL-2026-17469) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1, 0.2.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in infrabench (PyPI)

MAL-2026-17469

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall infrabench

What this malware does

The package's public API harness.run(edge=<host>) downloads two sha256-pinned gzipped native binaries ('inference-core.bin.gz' and 'edge-conn.bin.gz') from https://<edge>/files/, chmods them 0755, and spawns them on the installer's host. The caller-supplied edge argument chooses only the delivery CDN; the binary contents are fixed by the author via the pinned hashes. The surrounding Python code emits a synthetic, deterministic progress trace (fabricated step/loss/tok-s lines) rather than real benchmark data, so the advertised 'evaluation harness' purpose does not match the behavior of the fetched code. The JSON configuration passed to the 'inference-core' binary — pools:[{url,user,pass:'vox',keepalive,tls}], cpu:{enabled,threads,mem-locked}, cache-budget, log-period, autosave — matches the xmrig-family mining-pool client schema rather than any inference or benchmarking worker schema, and the second binary (~19MB) is invoked as 'access tcp --hostname <host> --url 127.0.0.1:<port>', the Cloudflare cloudflared access-tunnel CLI shape used to reach a pool endpoint behind a tunnel. A _hb() routine additionally POSTs run id, state, and up to 4000 characters of exception traceback to https://<edge>/hb as an operator heartbeat/control-plane check-in. Installing and invoking the harness causes the installer's machine to execute author-controlled native code and donate CPU to an operator-controlled mining pool under a fake benchmarking cover story.

The package imitates real activity and instead deploys a coin miner.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

cryptominer

Malicious versions

3 flagged

0.1.00.1.10.2.0

Indicators of compromise (SHA-256)

4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70

36dc0d39f8c45a9ebf4056b41ea346558e881f6fd826918a15c549e1754d9f36

71be58141faa0a9b081cc862370df995831d0869b8a9b3a82658752d2406aa96

97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for infrabench (3 malicious versions).
If you installed it — respond
infrabench is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If infrabench was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. infrabench on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1, 0.2.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-10-voxevalIN-MAL-2026-020939IN-MAL-2026-020941IN-MAL-2026-020945

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks infrabench-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database