Which versions of voxcpmtts3 are malicious?

The following PyPI versions of voxcpmtts3 are flagged malicious: 0.1.0, 0.1.1, 0.1.2. Treat any of these as compromised.

How do I remediate voxcpmtts3 if I installed it?

voxcpmtts3 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed voxcpmtts3 — how do I know if it already compromised me?

If voxcpmtts3 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is voxcpmtts3 part of a known attack campaign?

Yes — voxcpmtts3 is associated with the 2026-10-voxeval, IN-MAL-2026-020924, IN-MAL-2026-020922, IN-MAL-2026-020923 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find voxcpmtts3 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for voxcpmtts3 (3 malicious versions).

Part of a larger attack: 2026-10-voxeval published 11 malicious packages. See the full campaign →

Malicious package

voxcpmtts3PyPI

Advisory published Oct 3, 2026Updated Oct 4, 2026

voxcpmtts3 is a confirmed malicious PyPI package (MAL-2026-17463) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1, 0.1.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in voxcpmtts3 (PyPI)

MAL-2026-17463

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall voxcpmtts3

What this malware does

The package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload. voxcpmtts3/bin/voxcpm-core is XMRig (contains Monero/RandomX/CryptoNight/stratum/Hashrate/DONATE strings); harness.run() chmods it executable and spawns it via subprocess.Popen with a JSON config whose top-level key is assembled by string concatenation ("po"+"ols") to evade static analysis, carrying stratum-protocol fields (user/pass/keepalive/tls). A second bundled binary, voxcpmtts3/bin/cloudflared (~40MB), is launched with 'access tcp --hostname <edge> --url 127.0.0.1:<port>' to open a raw TCP tunnel through Cloudflare Access, hiding the real mining pool address behind a Cloudflare Access hostname and defeating destination-based blocking; a code comment acknowledges the design is to keep the traffic readable at the Cloudflare front door. In parallel, self._hb() POSTs run_id, state, Python tracebacks (up to 4000 chars) and timestamps to https://<edge>/hb through the same attacker-controlled Cloudflare Access hostname, giving the operator a per-victim telemetry channel that also leaks local filesystem paths from error traces. The 'TTS inference', 'coordinator', and 'step/loss/tok/s' terminology in code and README is cover for stratum mining pool concepts.

The package imitates real activity and instead deploys a coin miner.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

cryptominer

Malicious versions

3 flagged

0.1.00.1.10.1.2

Indicators of compromise (SHA-256)

382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d

208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5

9d7d7476702ef89959e2c63507d596f94f468a01bc8ce00c551fbed2f5efcf29

aa2cca2e72cf0e735230017b491728f699d1b4cd8137088f12791db0d3a1681c

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for voxcpmtts3 (3 malicious versions).
If you installed it — respond
voxcpmtts3 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If voxcpmtts3 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. voxcpmtts3 on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1, 0.1.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-10-voxevalIN-MAL-2026-020924IN-MAL-2026-020922IN-MAL-2026-020923

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks voxcpmtts3-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database