Supply chain · pip · High

Malicious pip package 'caoxiltts' deploys coin miner

Threat Engine Auto-Feed · data current as of 2026-10-04

The pip package 'caoxiltts' version 0.1.0 has been identified as malicious, deploying a coin miner upon installation. Organizations using this package are exposed to unauthorized resource consumption and potential system instability.

  • Package: pip / caoxiltts
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: ~768/wk
  • Exposure: 70/100 (High)

What happened — Crypto / wallet targeting

The pip package 'caoxiltts' version 0.1.0 contains malicious code. Instead of legitimate functionality, it deploys a coin miner, leveraging system resources for cryptocurrency mining without authorization.

How the attack works

This is a software supply-chain attack where a malicious package is published to a public registry. When developers or automated systems install this package as a dependency, the embedded malicious code executes, typically during installation or when the package is imported/run. In this case, the payload initiates unauthorized resource-intensive operations.

Who's exposed

Profiles most at risk

  • Development teams using the pip ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any system or environment where 'caoxiltts' version 0.1.0 was installed

Conditions that increase exposure

  • Unpinned dependencies in project configurations (e.g., requirements.txt without specific versions)
  • Lack of dependency lockfiles (e.g., Pipfile.lock, poetry.lock) or not enforcing their use
  • Use of internal package mirrors that do not vet upstream packages
  • Automated builds that install dependencies without prior security scanning

Blast-radius scenarios

  • Unauthorized consumption of CPU and memory resources on affected systems due to coin mining.
  • Degradation of system performance and increased operational costs (e.g., cloud compute bills).
  • Potential for system instability or crashes due to resource exhaustion.
  • Compromise of development or production environments where the package was installed, serving as a beachhead for further malicious activity.

What to do (defensive)

Detect

  • Scan dependency trees for 'caoxiltts' version 0.1.0 in all projects and environments.
  • Monitor system resource utilization (CPU, memory) for unexpected spikes or sustained high usage, especially on build agents or servers.
  • Review network traffic for connections to known cryptocurrency mining pools or unusual outbound connections from development/production systems.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your codebase.

Contain

  • Immediately isolate any systems or environments found to have installed 'caoxiltts' version 0.1.0.
  • Block 'caoxiltts' from being downloaded from package registries or internal mirrors.
  • Temporarily suspend builds or deployments that might pull new dependencies until a review is complete.

Remediate

  • Remove 'caoxiltts' version 0.1.0 from all affected projects and environments.
  • Perform a clean re-installation of dependencies, ensuring only trusted versions are used.
  • Implement strict dependency version pinning (e.g., `caoxiltts==0.0.1`) and enforce the use of lockfiles.
  • Conduct a thorough security audit of all systems where the package was installed to check for persistence mechanisms or further compromise.

Frontier verdict — High

Prioritize immediate detection and removal of 'caoxiltts' version 0.1.0 due to its critical severity and unauthorized resource consumption.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.