Supply chain · pip · High

CRITICAL: Malicious 'voxcpmintel' PyPI Package Deploys Coin Miner

Threat Engine Auto-Feed · data current as of 2026-10-03

The PyPI package 'voxcpmintel' version 0.1.0 has been identified as malicious, deploying a coin miner upon installation. This poses a critical supply-chain risk for Python environments, as it can lead to unauthorized resource consumption and potential system instability. Immediate action is required to identify and remove this package from all affected systems.

  • Package: pip / voxcpmintel
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Crypto / wallet targeting

The 'voxcpmintel' package, specifically version 0.1.0, was published to the PyPI registry with malicious intent. Instead of providing legitimate functionality, it is designed to install and run a coin miner on systems where it is deployed.

How the attack works

This is a software supply-chain attack where a malicious package is introduced into a public registry. When developers or automated systems install this package as a dependency, the embedded malicious code executes, typically during installation or when the package is imported. In this case, the payload initiates unauthorized cryptocurrency mining, leveraging the host system's resources without explicit consent.

Who's exposed

Profiles most at risk

  • Development teams using Python and PyPI for dependencies
  • CI/CD pipelines that automatically pull and install Python packages
  • Organizations with internal package mirrors that may have synced 'voxcpmintel'

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest version of 'voxcpmintel'
  • Lack of a lockfile (e.g., requirements.txt.lock, poetry.lock) to ensure deterministic builds
  • Automated build processes that do not vet new package versions or sources
  • Environments where 'voxcpmintel' was directly or indirectly listed as a dependency

Blast-radius scenarios

  • If 'voxcpmintel' is installed, an attacker gains unauthorized use of system resources for cryptocurrency mining, leading to increased CPU/GPU usage, higher power consumption, and potential performance degradation.
  • The presence of a coin miner can indicate a compromise of the build environment or application, potentially opening doors for further malicious activity or resource abuse.

What to do (defensive)

Detect

  • Scan all Python project dependency lists (e.g., requirements.txt, pyproject.toml) for 'voxcpmintel==0.1.0'.
  • Review build logs and package installation histories for any instances of 'voxcpmintel' being installed.
  • Monitor system resource utilization (CPU, GPU) for unexpected spikes or sustained high usage on servers or workstations that recently installed Python dependencies.

Contain

  • Immediately quarantine or isolate any systems identified with 'voxcpmintel' installed.
  • Block 'voxcpmintel' from being downloaded from PyPI or internal mirrors.
  • Review and update dependency management practices to pin all package versions and use lockfiles to prevent unexpected package updates.

Remediate

  • Remove 'voxcpmintel' from all affected environments and dependency lists.
  • Perform a clean rebuild of applications and environments from trusted sources after removing the malicious package.
  • Conduct a thorough security audit of any systems where 'voxcpmintel' was found to ensure no other malicious components were introduced or persist.

Frontier verdict — High

Prioritize immediate detection and removal of 'voxcpmintel' due to its critical severity and direct resource abuse via coin mining.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.