Supply chain · pip · High

Malicious pip Package 'voxcpmui4' Deploys Coin Miner

Threat Engine Auto-Feed · data current as of 2026-10-03

A malicious package, 'voxcpmui4' version 0.2.0, has been identified in the pip ecosystem. This package, disguised as legitimate activity, is designed to deploy a coin miner on compromised systems, posing a critical risk to resource integrity and operational costs.

  • Package: pip / voxcpmui4
  • Affected versions: = 0.2.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Crypto / wallet targeting

The pip package 'voxcpmui4' version 0.2.0 contains malicious code. This package imitates legitimate software but, upon execution, deploys a coin miner. The intent is clearly malicious, categorized as a cryptominer campaign.

How the attack works

This is a supply-chain attack where a seemingly benign software package is introduced into a public repository. When developers or automated systems integrate this package into their projects, the malicious code is executed. In this instance, the payload is a coin miner, which secretly utilizes system resources for cryptocurrency mining, impacting performance and increasing resource consumption.

Who's exposed

Profiles most at risk

  • Development teams using the pip ecosystem
  • Organizations with CI/CD pipelines that automatically pull the latest package versions
  • Any system or environment where 'voxcpmui4' version 0.2.0 has been installed

Conditions that increase exposure

  • Unpinned dependencies in project configurations
  • Lack of dependency lockfiles (e.g., requirements.txt with exact versions)
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build processes that do not scan new dependencies for known malicious indicators

Blast-radius scenarios

  • Installation of 'voxcpmui4' leads to unauthorized resource consumption on developer workstations or build servers.
  • Production systems that inadvertently include the malicious package could experience performance degradation and increased operational costs due to hidden coin mining.
  • Compromised systems could serve as a platform for further malicious activities, though the primary identified threat is cryptomining.

What to do (defensive)

Detect

  • Scan project dependencies for 'voxcpmui4' version 0.2.0 using dependency scanning tools.
  • Monitor system resource utilization for unexpected spikes in CPU or memory usage, which could indicate unauthorized mining activity.
  • Review network traffic for connections to known cryptocurrency mining pools or unusual outbound connections from development or production environments.

Contain

  • Immediately quarantine or isolate any systems identified with 'voxcpmui4' version 0.2.0 installed.
  • Block 'voxcpmui4' version 0.2.0 from being pulled from package registries in your environment.
  • Revoke any credentials or API keys that might have been exposed on compromised systems, assuming potential broader compromise.

Remediate

  • Uninstall 'voxcpmui4' version 0.2.0 from all affected systems.
  • Rebuild affected applications and environments using verified, clean dependencies, ensuring specific versions are pinned.
  • Implement strict dependency version pinning and regularly audit third-party packages for known vulnerabilities and malicious activity.

Frontier verdict — High

Prioritize immediate detection and removal of 'voxcpmui4' due to its critical severity as a cryptominer in the pip ecosystem.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.